Analysis
-
max time kernel
150s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 11:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe
-
Size
196KB
-
MD5
638ebaf1bea8850ca9ada168c65de1c6
-
SHA1
1bbcefb36ffab914c5606d3c944e1c3a493a1d78
-
SHA256
b3433542361a92fee7c35339e42ed35682151e1cb7c94116f0259a19954b1f76
-
SHA512
ca7242c7dbf8d44b0371b5063f65652298d84e00bb684f4416eeef34249075d66a3b1651528c7d1acadbdf7e3e6ae930cab8e86b2e1691335782806c15d9c3dc
-
SSDEEP
3072:lPfoxhGuluhBNIyOZt6T5e2GsFEjyKItKJximQdHpTEOA3SNP8PA:x2GIy+6T57GsFEv3JAmahUOP8Y
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" -
Renames multiple (74) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ZaYEcAoQ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation ZaYEcAoQ.exe -
Executes dropped EXE 2 IoCs
Processes:
tcksAcMg.exeZaYEcAoQ.exepid process 904 tcksAcMg.exe 1448 ZaYEcAoQ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeZaYEcAoQ.exetcksAcMg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tcksAcMg.exe = "C:\\Users\\Admin\\mGYsQEkk\\tcksAcMg.exe" 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZaYEcAoQ.exe = "C:\\ProgramData\\yAAQEgcE\\ZaYEcAoQ.exe" 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZaYEcAoQ.exe = "C:\\ProgramData\\yAAQEgcE\\ZaYEcAoQ.exe" ZaYEcAoQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tcksAcMg.exe = "C:\\Users\\Admin\\mGYsQEkk\\tcksAcMg.exe" tcksAcMg.exe -
Drops file in System32 directory 2 IoCs
Processes:
ZaYEcAoQ.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe ZaYEcAoQ.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe ZaYEcAoQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4500 reg.exe 1012 reg.exe 3708 reg.exe 4736 reg.exe 3632 reg.exe 2128 508 4304 reg.exe 4520 reg.exe 4872 reg.exe 3000 reg.exe 3160 reg.exe 2588 3104 4104 reg.exe 1764 reg.exe 1112 reg.exe 4068 4640 2020 4616 reg.exe 1868 reg.exe 2400 reg.exe 2484 reg.exe 4872 reg.exe 2532 reg.exe 4352 reg.exe 1080 4184 reg.exe 4568 reg.exe 4304 reg.exe 2568 reg.exe 4708 reg.exe 364 reg.exe 5024 reg.exe 1572 2856 reg.exe 4396 reg.exe 1948 reg.exe 3396 reg.exe 1072 reg.exe 2736 3384 reg.exe 3056 2884 reg.exe 2372 1520 reg.exe 4396 4704 reg.exe 1756 reg.exe 4512 reg.exe 2084 512 reg.exe 4300 reg.exe 3600 reg.exe 4736 reg.exe 3180 3584 reg.exe 3240 1688 reg.exe 2692 reg.exe 2448 reg.exe 1072 reg.exe 1804 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exepid process 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2456 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2456 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2456 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2456 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1820 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1820 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1820 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 1820 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 4644 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 4644 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 4644 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 4644 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 3116 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 3116 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 3116 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 3116 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2572 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2572 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2572 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2572 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 972 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 972 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 972 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 972 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 4572 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 4572 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 4572 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 4572 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2496 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2496 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2496 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2496 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2092 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2092 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2092 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2092 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2880 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2880 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2880 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2880 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2876 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2876 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2876 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2876 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 808 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 808 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 808 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 808 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2588 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2588 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2588 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe 2588 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ZaYEcAoQ.exepid process 1448 ZaYEcAoQ.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
ZaYEcAoQ.exepid process 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe 1448 ZaYEcAoQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.execmd.execmd.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.execmd.execmd.exe2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.execmd.exedescription pid process target process PID 712 wrote to memory of 904 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe tcksAcMg.exe PID 712 wrote to memory of 904 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe tcksAcMg.exe PID 712 wrote to memory of 904 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe tcksAcMg.exe PID 712 wrote to memory of 1448 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe ZaYEcAoQ.exe PID 712 wrote to memory of 1448 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe ZaYEcAoQ.exe PID 712 wrote to memory of 1448 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe ZaYEcAoQ.exe PID 712 wrote to memory of 3856 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 712 wrote to memory of 3856 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 712 wrote to memory of 3856 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 712 wrote to memory of 3008 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 712 wrote to memory of 3008 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 712 wrote to memory of 3008 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 712 wrote to memory of 2876 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 712 wrote to memory of 2876 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 712 wrote to memory of 2876 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 712 wrote to memory of 2568 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 712 wrote to memory of 2568 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 712 wrote to memory of 2568 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 712 wrote to memory of 3204 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 712 wrote to memory of 3204 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 712 wrote to memory of 3204 712 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3856 wrote to memory of 2416 3856 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 3856 wrote to memory of 2416 3856 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 3856 wrote to memory of 2416 3856 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 3204 wrote to memory of 4276 3204 cmd.exe cscript.exe PID 3204 wrote to memory of 4276 3204 cmd.exe cscript.exe PID 3204 wrote to memory of 4276 3204 cmd.exe cscript.exe PID 2416 wrote to memory of 3616 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2416 wrote to memory of 3616 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2416 wrote to memory of 3616 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3616 wrote to memory of 3244 3616 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 3616 wrote to memory of 3244 3616 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 3616 wrote to memory of 3244 3616 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 2416 wrote to memory of 4248 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2416 wrote to memory of 4248 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2416 wrote to memory of 4248 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2416 wrote to memory of 3768 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2416 wrote to memory of 3768 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2416 wrote to memory of 3768 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2416 wrote to memory of 2812 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2416 wrote to memory of 2812 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2416 wrote to memory of 2812 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 2416 wrote to memory of 3500 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2416 wrote to memory of 3500 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 2416 wrote to memory of 3500 2416 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3500 wrote to memory of 2588 3500 cmd.exe cscript.exe PID 3500 wrote to memory of 2588 3500 cmd.exe cscript.exe PID 3500 wrote to memory of 2588 3500 cmd.exe cscript.exe PID 3244 wrote to memory of 3748 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3244 wrote to memory of 3748 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3244 wrote to memory of 3748 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe PID 3748 wrote to memory of 2456 3748 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 3748 wrote to memory of 2456 3748 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 3748 wrote to memory of 2456 3748 cmd.exe 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe PID 3244 wrote to memory of 2532 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3244 wrote to memory of 2532 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3244 wrote to memory of 2532 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3244 wrote to memory of 812 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3244 wrote to memory of 812 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3244 wrote to memory of 812 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3244 wrote to memory of 4376 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3244 wrote to memory of 4376 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3244 wrote to memory of 4376 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe reg.exe PID 3244 wrote to memory of 3984 3244 2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\mGYsQEkk\tcksAcMg.exe"C:\Users\Admin\mGYsQEkk\tcksAcMg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:904 -
C:\ProgramData\yAAQEgcE\ZaYEcAoQ.exe"C:\ProgramData\yAAQEgcE\ZaYEcAoQ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"8⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"10⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"12⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"14⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"16⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"18⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"20⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"22⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"24⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"26⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"28⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"30⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"32⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock33⤵PID:1764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"34⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock35⤵PID:5064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"36⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock37⤵PID:3204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"38⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock39⤵PID:4184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"40⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock41⤵PID:3340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"42⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock43⤵PID:5076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"44⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock45⤵PID:3568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"46⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock47⤵PID:3544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"48⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock49⤵PID:2036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"50⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock51⤵PID:2716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"52⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock53⤵PID:1764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"54⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock55⤵PID:4672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"56⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock57⤵PID:4728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"58⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock59⤵PID:3952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"60⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock61⤵PID:428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"62⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock63⤵PID:680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"64⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock65⤵PID:3240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"66⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock67⤵PID:1948
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"68⤵PID:2124
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock69⤵PID:2492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"70⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock71⤵PID:1588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"72⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock73⤵PID:2016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"74⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock75⤵PID:4292
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"76⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock77⤵PID:812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"78⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock79⤵PID:4144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"80⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock81⤵PID:2248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"82⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock83⤵PID:4588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"84⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock85⤵PID:3600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"86⤵PID:1284
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock87⤵PID:4980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"88⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock89⤵PID:3340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"90⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock91⤵PID:4412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"92⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock93⤵PID:1648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"94⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock95⤵PID:1004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"96⤵PID:4152
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock97⤵PID:4312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"98⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock99⤵PID:2536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"100⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock101⤵PID:2572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"102⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock103⤵PID:4444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"104⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock105⤵PID:4928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"106⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock107⤵PID:3584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"108⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock109⤵PID:1108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"110⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock111⤵PID:3428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"112⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock113⤵PID:4512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"114⤵PID:3448
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock115⤵PID:3116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"116⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock117⤵PID:1572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"118⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock119⤵PID:4500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"120⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock121⤵PID:4520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"122⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock123⤵PID:4568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"124⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock125⤵PID:3540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"126⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock127⤵PID:3736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"128⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock129⤵PID:1868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"130⤵PID:2324
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1131⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock131⤵PID:2920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"132⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock133⤵PID:552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"134⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock135⤵PID:4188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"136⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock137⤵PID:4696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"138⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock139⤵PID:3856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"140⤵PID:5076
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock141⤵PID:3180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"142⤵PID:3700
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1143⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock143⤵PID:5060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"144⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock145⤵PID:2360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"146⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock147⤵PID:4072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"148⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock149⤵PID:4292
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"150⤵PID:3068
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock151⤵PID:4064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"152⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock153⤵PID:428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"154⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock155⤵PID:1764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"156⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock157⤵PID:1104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"158⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock159⤵PID:788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"160⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock161⤵PID:4396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"162⤵PID:2372
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1163⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock163⤵PID:5076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"164⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock165⤵PID:3384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"166⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock167⤵PID:624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"168⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock169⤵PID:548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"170⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock171⤵PID:3156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"172⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock173⤵PID:3584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"174⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock175⤵PID:4420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"176⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock177⤵PID:3592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"178⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock179⤵PID:1764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"180⤵PID:3712
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock181⤵PID:3188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"182⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock183⤵PID:2496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"184⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock185⤵PID:1080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"186⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock187⤵PID:2344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"188⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock189⤵PID:212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"190⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock191⤵PID:1864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"192⤵PID:4040
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1193⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock193⤵PID:2712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"194⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock195⤵PID:2900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"196⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock197⤵PID:3684
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"198⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock199⤵PID:3500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"200⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock201⤵PID:2124
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"202⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock203⤵PID:2900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"204⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock205⤵PID:3748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"206⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock207⤵PID:4672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"208⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock209⤵PID:1072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"210⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock211⤵PID:2868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"212⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock213⤵PID:5108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"214⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock215⤵PID:4184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"216⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock217⤵PID:744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"218⤵PID:3908
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock219⤵PID:4204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"220⤵PID:4200
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock221⤵PID:2768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"222⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock223⤵PID:1312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"224⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock225⤵PID:3748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"226⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock227⤵PID:3996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"228⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock229⤵PID:3820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"230⤵PID:2780
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock231⤵PID:2360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"232⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock233⤵PID:1824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"234⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock235⤵PID:4712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"236⤵PID:4996
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1237⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock237⤵PID:3160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"238⤵PID:5112
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1239⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock239⤵PID:2768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock"240⤵PID:1284
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-28_638ebaf1bea8850ca9ada168c65de1c6_virlock241⤵PID:400
-