Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe
-
Size
190KB
-
MD5
617e906c7eddc96288b409e78c1ec01c
-
SHA1
d13c9c42ac9adb825485c4dae87b50190413070d
-
SHA256
15dc6d8cd97ec807ed9c0f49499c7cdb89bfc1c8a9d0b2f5db0cd9ddc401596e
-
SHA512
cc9a02f2e038f4ac63af88bdb87bef569b62c5ab897bcfff8baa6f1750ee04408399ca34224c4020481ec0b8daa2e5620f68f8bd30d07e6ba9a4308f4cb29ebe
-
SSDEEP
3072:8U4+823/aJBn05lzpYhPYWVfWKBu80MBQPY4ppAeWjhJZTXHG6pC9mH:14+823/aJp0iYWVdBuEBOY4bpWjDZTXn
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation OQMcIcQY.exe -
Deletes itself 1 IoCs
pid Process 1236 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2680 OQMcIcQY.exe 2632 deMIsAEI.exe -
Loads dropped DLL 20 IoCs
pid Process 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\OQMcIcQY.exe = "C:\\Users\\Admin\\cgYEgEsU\\OQMcIcQY.exe" 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\deMIsAEI.exe = "C:\\ProgramData\\HWEkAYco\\deMIsAEI.exe" 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\OQMcIcQY.exe = "C:\\Users\\Admin\\cgYEgEsU\\OQMcIcQY.exe" OQMcIcQY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\deMIsAEI.exe = "C:\\ProgramData\\HWEkAYco\\deMIsAEI.exe" deMIsAEI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 1032 reg.exe 2512 reg.exe 1348 reg.exe 2752 reg.exe 1768 reg.exe 1768 reg.exe 2348 reg.exe 1924 reg.exe 1772 reg.exe 2492 reg.exe 448 reg.exe 692 reg.exe 272 reg.exe 1744 reg.exe 2832 reg.exe 2496 reg.exe 2876 reg.exe 840 reg.exe 2616 reg.exe 2116 reg.exe 1952 reg.exe 1872 reg.exe 1808 reg.exe 840 reg.exe 2828 reg.exe 1812 reg.exe 692 reg.exe 2008 reg.exe 2560 reg.exe 2096 reg.exe 1688 reg.exe 2012 reg.exe 1408 reg.exe 2832 reg.exe 900 reg.exe 1952 reg.exe 2740 reg.exe 2136 reg.exe 2856 reg.exe 2752 reg.exe 2900 reg.exe 1428 reg.exe 1808 reg.exe 1848 reg.exe 2708 reg.exe 1040 reg.exe 2068 reg.exe 2880 reg.exe 1836 reg.exe 612 reg.exe 2140 reg.exe 1580 reg.exe 760 reg.exe 1252 reg.exe 2096 reg.exe 2964 reg.exe 868 reg.exe 1540 reg.exe 1244 reg.exe 2744 reg.exe 800 reg.exe 1212 reg.exe 584 reg.exe 2500 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2804 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2804 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2024 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2024 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 320 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 320 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1108 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1108 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 580 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 580 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2396 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2396 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2824 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2824 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2188 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2188 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1948 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1948 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1604 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1604 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1292 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1292 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2556 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2556 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1364 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1364 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2676 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2676 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2228 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2228 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1436 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1436 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2144 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2144 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2748 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2748 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2500 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2500 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1820 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1820 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2676 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2676 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2988 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2988 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2248 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2248 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 296 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 296 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2132 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2132 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2516 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2516 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 324 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 324 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2676 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2676 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2684 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2684 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1848 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1848 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2680 OQMcIcQY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe 2680 OQMcIcQY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 840 wrote to memory of 2680 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 28 PID 840 wrote to memory of 2680 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 28 PID 840 wrote to memory of 2680 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 28 PID 840 wrote to memory of 2680 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 28 PID 840 wrote to memory of 2632 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 29 PID 840 wrote to memory of 2632 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 29 PID 840 wrote to memory of 2632 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 29 PID 840 wrote to memory of 2632 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 29 PID 840 wrote to memory of 2616 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 30 PID 840 wrote to memory of 2616 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 30 PID 840 wrote to memory of 2616 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 30 PID 840 wrote to memory of 2616 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 30 PID 2616 wrote to memory of 2496 2616 cmd.exe 32 PID 2616 wrote to memory of 2496 2616 cmd.exe 32 PID 2616 wrote to memory of 2496 2616 cmd.exe 32 PID 2616 wrote to memory of 2496 2616 cmd.exe 32 PID 840 wrote to memory of 2744 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 33 PID 840 wrote to memory of 2744 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 33 PID 840 wrote to memory of 2744 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 33 PID 840 wrote to memory of 2744 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 33 PID 840 wrote to memory of 2608 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 34 PID 840 wrote to memory of 2608 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 34 PID 840 wrote to memory of 2608 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 34 PID 840 wrote to memory of 2608 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 34 PID 840 wrote to memory of 2652 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 35 PID 840 wrote to memory of 2652 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 35 PID 840 wrote to memory of 2652 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 35 PID 840 wrote to memory of 2652 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 35 PID 840 wrote to memory of 2656 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 38 PID 840 wrote to memory of 2656 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 38 PID 840 wrote to memory of 2656 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 38 PID 840 wrote to memory of 2656 840 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 38 PID 2656 wrote to memory of 2540 2656 cmd.exe 41 PID 2656 wrote to memory of 2540 2656 cmd.exe 41 PID 2656 wrote to memory of 2540 2656 cmd.exe 41 PID 2656 wrote to memory of 2540 2656 cmd.exe 41 PID 2496 wrote to memory of 2772 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 42 PID 2496 wrote to memory of 2772 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 42 PID 2496 wrote to memory of 2772 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 42 PID 2496 wrote to memory of 2772 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 42 PID 2772 wrote to memory of 2804 2772 cmd.exe 44 PID 2772 wrote to memory of 2804 2772 cmd.exe 44 PID 2772 wrote to memory of 2804 2772 cmd.exe 44 PID 2772 wrote to memory of 2804 2772 cmd.exe 44 PID 2496 wrote to memory of 2832 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 45 PID 2496 wrote to memory of 2832 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 45 PID 2496 wrote to memory of 2832 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 45 PID 2496 wrote to memory of 2832 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 45 PID 2496 wrote to memory of 1836 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 46 PID 2496 wrote to memory of 1836 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 46 PID 2496 wrote to memory of 1836 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 46 PID 2496 wrote to memory of 1836 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 46 PID 2496 wrote to memory of 1284 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 47 PID 2496 wrote to memory of 1284 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 47 PID 2496 wrote to memory of 1284 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 47 PID 2496 wrote to memory of 1284 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 47 PID 2496 wrote to memory of 1244 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 48 PID 2496 wrote to memory of 1244 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 48 PID 2496 wrote to memory of 1244 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 48 PID 2496 wrote to memory of 1244 2496 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 48 PID 1244 wrote to memory of 2160 1244 cmd.exe 53 PID 1244 wrote to memory of 2160 1244 cmd.exe 53 PID 1244 wrote to memory of 2160 1244 cmd.exe 53 PID 1244 wrote to memory of 2160 1244 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\cgYEgEsU\OQMcIcQY.exe"C:\Users\Admin\cgYEgEsU\OQMcIcQY.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2680
-
-
C:\ProgramData\HWEkAYco\deMIsAEI.exe"C:\ProgramData\HWEkAYco\deMIsAEI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2632
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2804 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"6⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2024 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"8⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:320 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"10⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"12⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:580 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"14⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"16⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2824 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"18⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2188 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"20⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1948 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"22⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"24⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1292 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"26⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"28⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:1364 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"30⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"32⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2228 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"34⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1436 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"36⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:2144 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"38⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"40⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2500 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"42⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"44⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"46⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:2988 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"48⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:2248 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"50⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:296 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"52⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2132 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"54⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:2516 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"56⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:324 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"58⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"60⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2684 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"62⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:1848 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"64⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock65⤵PID:1924
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"66⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock67⤵PID:2880
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"68⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock69⤵PID:1040
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"70⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock71⤵PID:320
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"72⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock73⤵PID:2896
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"74⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock75⤵PID:2620
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"76⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock77⤵PID:2108
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"78⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock79⤵PID:1648
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"80⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock81⤵PID:540
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"82⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock83⤵PID:1040
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"84⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock85⤵PID:2072
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"86⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock87⤵PID:2656
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"88⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock89⤵PID:2728
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"90⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock91⤵PID:1884
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"92⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock93⤵PID:388
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"94⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock95⤵PID:2460
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"96⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock97⤵PID:1948
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"98⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock99⤵PID:2228
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"100⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock101⤵PID:2608
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"102⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock103⤵PID:1148
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"104⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock105⤵PID:2368
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"106⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock107⤵PID:2932
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"108⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock109⤵PID:1848
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"110⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock111⤵PID:2500
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"112⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock113⤵PID:2980
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"114⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock115⤵PID:1204
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"116⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock117⤵PID:2176
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"118⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock119⤵PID:2608
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"120⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock121⤵PID:1908
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"122⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-