Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 21:40
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe
-
Size
206KB
-
MD5
603265859f744615bb91f46a55c837ef
-
SHA1
3092544ff20a4dfbc93b9f40df451b0530921e42
-
SHA256
99bd1785216647cb7ae901102b93771477fd8659027902cd769c2c5a75490645
-
SHA512
b8aca8d07f5997f5d527ab88521fa8d5ab1db52318e8b12ad08e0a8e9e111c64e7b995b29f263259eda16c82cf046335cc49be5e3d4b7f0151932f1b1d650f30
-
SSDEEP
3072:ZarrtQNBGldrMfEU+l9Srlru/k1Za42DeH/gF34qCfEmMuv+QUkC6BM6a/:srrtQizrY8aoHV4vJ5veMM6
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation usUEsMgA.exe -
Executes dropped EXE 2 IoCs
pid Process 1136 usUEsMgA.exe 2620 YwwIAUIo.exe -
Loads dropped DLL 20 IoCs
pid Process 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\YwwIAUIo.exe = "C:\\ProgramData\\gUMAAoQc\\YwwIAUIo.exe" 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\usUEsMgA.exe = "C:\\Users\\Admin\\EMgokEYw\\usUEsMgA.exe" usUEsMgA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\YwwIAUIo.exe = "C:\\ProgramData\\gUMAAoQc\\YwwIAUIo.exe" YwwIAUIo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\sqUoMkUo.exe = "C:\\Users\\Admin\\JAIcUMUw\\sqUoMkUo.exe" 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SAQEEEAo.exe = "C:\\ProgramData\\Ucscscog\\SAQEEEAo.exe" 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\usUEsMgA.exe = "C:\\Users\\Admin\\EMgokEYw\\usUEsMgA.exe" 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico usUEsMgA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2608 2636 WerFault.exe 474 2968 2332 WerFault.exe 475 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 1620 reg.exe 2392 reg.exe 2980 reg.exe 2328 reg.exe 2448 reg.exe 764 reg.exe 2444 reg.exe 2852 reg.exe 1944 reg.exe 1224 reg.exe 1420 reg.exe 1800 reg.exe 1556 reg.exe 796 reg.exe 2600 reg.exe 2292 reg.exe 1960 reg.exe 1068 reg.exe 1000 reg.exe 2772 reg.exe 908 reg.exe 1064 reg.exe 1480 reg.exe 944 reg.exe 2176 reg.exe 1776 reg.exe 2084 reg.exe 564 reg.exe 1452 reg.exe 1392 reg.exe 2836 reg.exe 1984 reg.exe 2664 reg.exe 2764 reg.exe 2140 reg.exe 1612 reg.exe 1696 reg.exe 1984 reg.exe 1580 reg.exe 1692 reg.exe 2468 reg.exe 2040 reg.exe 2256 reg.exe 3032 reg.exe 2500 reg.exe 776 reg.exe 552 reg.exe 1068 reg.exe 2832 reg.exe 2288 reg.exe 2640 reg.exe 2560 reg.exe 2716 reg.exe 2928 reg.exe 1552 reg.exe 2448 reg.exe 2856 reg.exe 2112 reg.exe 1696 reg.exe 1064 reg.exe 2576 reg.exe 2624 reg.exe 928 reg.exe 2136 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2336 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2336 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2948 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2948 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2024 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2024 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1332 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1332 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2524 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2524 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2596 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2596 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2444 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2444 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 876 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 876 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1092 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1092 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1728 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1728 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1060 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1060 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2488 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2488 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2764 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2764 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2256 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2256 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 596 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 596 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 916 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 916 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 280 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 280 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2784 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2784 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 3008 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 3008 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2764 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2764 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1020 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1020 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2120 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2120 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 892 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 892 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2812 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2812 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 636 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 636 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1528 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1528 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1976 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 1976 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 588 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 588 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2072 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2072 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2684 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 2684 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1136 usUEsMgA.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe 1136 usUEsMgA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1136 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 28 PID 2240 wrote to memory of 1136 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 28 PID 2240 wrote to memory of 1136 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 28 PID 2240 wrote to memory of 1136 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 28 PID 2240 wrote to memory of 2620 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 29 PID 2240 wrote to memory of 2620 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 29 PID 2240 wrote to memory of 2620 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 29 PID 2240 wrote to memory of 2620 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 29 PID 2240 wrote to memory of 2644 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 30 PID 2240 wrote to memory of 2644 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 30 PID 2240 wrote to memory of 2644 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 30 PID 2240 wrote to memory of 2644 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 30 PID 2644 wrote to memory of 2668 2644 cmd.exe 32 PID 2644 wrote to memory of 2668 2644 cmd.exe 32 PID 2644 wrote to memory of 2668 2644 cmd.exe 32 PID 2644 wrote to memory of 2668 2644 cmd.exe 32 PID 2240 wrote to memory of 2448 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 33 PID 2240 wrote to memory of 2448 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 33 PID 2240 wrote to memory of 2448 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 33 PID 2240 wrote to memory of 2448 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 33 PID 2240 wrote to memory of 2588 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 34 PID 2240 wrote to memory of 2588 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 34 PID 2240 wrote to memory of 2588 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 34 PID 2240 wrote to memory of 2588 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 34 PID 2240 wrote to memory of 2556 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 36 PID 2240 wrote to memory of 2556 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 36 PID 2240 wrote to memory of 2556 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 36 PID 2240 wrote to memory of 2556 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 36 PID 2240 wrote to memory of 2468 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 39 PID 2240 wrote to memory of 2468 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 39 PID 2240 wrote to memory of 2468 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 39 PID 2240 wrote to memory of 2468 2240 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 39 PID 2468 wrote to memory of 2440 2468 cmd.exe 41 PID 2468 wrote to memory of 2440 2468 cmd.exe 41 PID 2468 wrote to memory of 2440 2468 cmd.exe 41 PID 2468 wrote to memory of 2440 2468 cmd.exe 41 PID 2668 wrote to memory of 2064 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 42 PID 2668 wrote to memory of 2064 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 42 PID 2668 wrote to memory of 2064 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 42 PID 2668 wrote to memory of 2064 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 42 PID 2064 wrote to memory of 2336 2064 cmd.exe 44 PID 2064 wrote to memory of 2336 2064 cmd.exe 44 PID 2064 wrote to memory of 2336 2064 cmd.exe 44 PID 2064 wrote to memory of 2336 2064 cmd.exe 44 PID 2668 wrote to memory of 2772 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 45 PID 2668 wrote to memory of 2772 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 45 PID 2668 wrote to memory of 2772 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 45 PID 2668 wrote to memory of 2772 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 45 PID 2668 wrote to memory of 2800 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 46 PID 2668 wrote to memory of 2800 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 46 PID 2668 wrote to memory of 2800 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 46 PID 2668 wrote to memory of 2800 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 46 PID 2668 wrote to memory of 2540 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 48 PID 2668 wrote to memory of 2540 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 48 PID 2668 wrote to memory of 2540 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 48 PID 2668 wrote to memory of 2540 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 48 PID 2668 wrote to memory of 2844 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 50 PID 2668 wrote to memory of 2844 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 50 PID 2668 wrote to memory of 2844 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 50 PID 2668 wrote to memory of 2844 2668 2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe 50 PID 2844 wrote to memory of 312 2844 cmd.exe 53 PID 2844 wrote to memory of 312 2844 cmd.exe 53 PID 2844 wrote to memory of 312 2844 cmd.exe 53 PID 2844 wrote to memory of 312 2844 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\EMgokEYw\usUEsMgA.exe"C:\Users\Admin\EMgokEYw\usUEsMgA.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1136
-
-
C:\ProgramData\gUMAAoQc\YwwIAUIo.exe"C:\ProgramData\gUMAAoQc\YwwIAUIo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2620
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"6⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2948 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"8⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2024 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"10⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1332 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"12⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:2524 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"14⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"16⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2444 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"18⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:876 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"20⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1092 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"22⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"24⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"26⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"28⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2764 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"30⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2256 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"32⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:596 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"34⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:916 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"36⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:280 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"38⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2784 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"40⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:3008 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"42⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:2764 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"44⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:1020 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"46⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:2120 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"48⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:892 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"50⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"52⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:636 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"54⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:1528 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"56⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"58⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:588 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"60⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2072 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"62⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2684 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"64⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock65⤵PID:1996
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"66⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock67⤵PID:2896
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"68⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock69⤵PID:1860
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"70⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock71⤵PID:1020
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"72⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock73⤵PID:1092
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"74⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock75⤵
- Adds Run key to start application
PID:2068 -
C:\Users\Admin\JAIcUMUw\sqUoMkUo.exe"C:\Users\Admin\JAIcUMUw\sqUoMkUo.exe"76⤵PID:2636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 3677⤵
- Program crash
PID:2608
-
-
-
C:\ProgramData\Ucscscog\SAQEEEAo.exe"C:\ProgramData\Ucscscog\SAQEEEAo.exe"76⤵PID:2332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 3677⤵
- Program crash
PID:2968
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"76⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock77⤵PID:2628
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"78⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock79⤵PID:1796
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"80⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock81⤵PID:1912
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"82⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock83⤵PID:1240
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"84⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock85⤵PID:2120
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"86⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock87⤵PID:2820
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"88⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock89⤵PID:2464
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"90⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock91⤵PID:1536
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"92⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock93⤵PID:1936
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"94⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock95⤵PID:2288
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"96⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock97⤵PID:2692
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"98⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock99⤵PID:280
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"100⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock101⤵PID:2556
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"102⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock103⤵PID:860
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"104⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock105⤵PID:1400
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"106⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock107⤵PID:2256
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"108⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock109⤵PID:620
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"110⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock111⤵PID:788
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"112⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock113⤵PID:1648
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"114⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock115⤵PID:764
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"116⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock117⤵PID:2292
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"118⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock119⤵PID:1764
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"120⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock121⤵PID:1788
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-22_603265859f744615bb91f46a55c837ef_virlock"122⤵PID:1640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-