Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 19:35
Static task
static1
Behavioral task
behavioral1
Sample
202405226a92195e4429fa42c588eb4193d18426virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
202405226a92195e4429fa42c588eb4193d18426virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
202405226a92195e4429fa42c588eb4193d18426virlock.exe
-
Size
189KB
-
MD5
6a92195e4429fa42c588eb4193d18426
-
SHA1
1ce3f60ff39f8497f47eadc456146f2bc04dc115
-
SHA256
da42c40cc93dadc086f85f730d8c76b91aef695e4aff37929fc08cc499a8ddc1
-
SHA512
f91b84e3e89183dea4ec0f9b44bf7595dd660659dd8a3f67e72ff0cc876497d4edf4bc4f2c52916f8343b732a35e90795662a05bbf122aeca87c82b89ce3ff2b
-
SSDEEP
3072:lkg2UE2ZPRBrVC+bmdxyd4m52dVFMKjIcxzzql4BkVP6LQ+9Xgm:lJ2UfbBrpbaIJAuKcYBkVP6cwg
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" -
Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 4 IoCs
Processes:
flow pid process 41 1096 44 1096 48 1096 49 1096 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ZGYcggIs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation ZGYcggIs.exe -
Executes dropped EXE 2 IoCs
Processes:
ZGYcggIs.exepugEUckk.exepid process 2292 ZGYcggIs.exe 1864 pugEUckk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
202405226a92195e4429fa42c588eb4193d18426virlock.exeZGYcggIs.exepugEUckk.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZGYcggIs.exe = "C:\\Users\\Admin\\yMwEcscI\\ZGYcggIs.exe" 202405226a92195e4429fa42c588eb4193d18426virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pugEUckk.exe = "C:\\ProgramData\\XKIEEwoQ\\pugEUckk.exe" 202405226a92195e4429fa42c588eb4193d18426virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZGYcggIs.exe = "C:\\Users\\Admin\\yMwEcscI\\ZGYcggIs.exe" ZGYcggIs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pugEUckk.exe = "C:\\ProgramData\\XKIEEwoQ\\pugEUckk.exe" pugEUckk.exe -
Drops file in System32 directory 1 IoCs
Processes:
ZGYcggIs.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe ZGYcggIs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2900 reg.exe 2304 reg.exe 956 reg.exe 2552 reg.exe 1912 reg.exe 4392 reg.exe 3600 reg.exe 3640 reg.exe 1128 reg.exe 4984 reg.exe 3340 reg.exe 1912 reg.exe 832 reg.exe 1212 reg.exe 4400 reg.exe 4492 reg.exe 4476 reg.exe 3788 reg.exe 4912 reg.exe 1476 320 reg.exe 1548 reg.exe 4360 reg.exe 2248 reg.exe 2552 reg.exe 4136 reg.exe 4376 reg.exe 2356 reg.exe 512 reg.exe 1296 reg.exe 2492 reg.exe 2316 reg.exe 3692 reg.exe 4888 reg.exe 3248 reg.exe 4428 reg.exe 3788 reg.exe 3992 reg.exe 4572 reg.exe 1912 reg.exe 2736 reg.exe 3884 reg.exe 2860 reg.exe 728 reg.exe 4872 reg.exe 2056 reg.exe 1496 4984 3692 reg.exe 728 2620 reg.exe 1212 reg.exe 2040 reg.exe 1296 reg.exe 1496 reg.exe 388 reg.exe 864 reg.exe 728 3640 876 2964 reg.exe 4048 reg.exe 3600 reg.exe 872 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exe202405226a92195e4429fa42c588eb4193d18426virlock.exepid process 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4872 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4872 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4872 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4872 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3788 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3788 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3788 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3788 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3168 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3168 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3168 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3168 202405226a92195e4429fa42c588eb4193d18426virlock.exe 876 202405226a92195e4429fa42c588eb4193d18426virlock.exe 876 202405226a92195e4429fa42c588eb4193d18426virlock.exe 876 202405226a92195e4429fa42c588eb4193d18426virlock.exe 876 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4836 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4836 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4836 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4836 202405226a92195e4429fa42c588eb4193d18426virlock.exe 208 202405226a92195e4429fa42c588eb4193d18426virlock.exe 208 202405226a92195e4429fa42c588eb4193d18426virlock.exe 208 202405226a92195e4429fa42c588eb4193d18426virlock.exe 208 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4688 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4688 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4688 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4688 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1172 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1172 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1172 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1172 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1504 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1504 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1504 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1504 202405226a92195e4429fa42c588eb4193d18426virlock.exe 2232 202405226a92195e4429fa42c588eb4193d18426virlock.exe 2232 202405226a92195e4429fa42c588eb4193d18426virlock.exe 2232 202405226a92195e4429fa42c588eb4193d18426virlock.exe 2232 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1488 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1488 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1488 202405226a92195e4429fa42c588eb4193d18426virlock.exe 1488 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3996 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3996 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3996 202405226a92195e4429fa42c588eb4193d18426virlock.exe 3996 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4552 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4552 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4552 202405226a92195e4429fa42c588eb4193d18426virlock.exe 4552 202405226a92195e4429fa42c588eb4193d18426virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ZGYcggIs.exepid process 2292 ZGYcggIs.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
ZGYcggIs.exepid process 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe 2292 ZGYcggIs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
202405226a92195e4429fa42c588eb4193d18426virlock.execmd.execmd.exe202405226a92195e4429fa42c588eb4193d18426virlock.execmd.execmd.exe202405226a92195e4429fa42c588eb4193d18426virlock.execmd.exedescription pid process target process PID 2512 wrote to memory of 2292 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe ZGYcggIs.exe PID 2512 wrote to memory of 2292 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe ZGYcggIs.exe PID 2512 wrote to memory of 2292 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe ZGYcggIs.exe PID 2512 wrote to memory of 1864 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe pugEUckk.exe PID 2512 wrote to memory of 1864 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe pugEUckk.exe PID 2512 wrote to memory of 1864 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe pugEUckk.exe PID 2512 wrote to memory of 3024 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 2512 wrote to memory of 3024 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 2512 wrote to memory of 3024 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 2512 wrote to memory of 2908 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 2512 wrote to memory of 2908 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 2512 wrote to memory of 2908 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 2512 wrote to memory of 3552 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 2512 wrote to memory of 3552 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 2512 wrote to memory of 3552 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 2512 wrote to memory of 4516 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 2512 wrote to memory of 4516 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 2512 wrote to memory of 4516 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 2512 wrote to memory of 872 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 2512 wrote to memory of 872 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 2512 wrote to memory of 872 2512 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 3024 wrote to memory of 4536 3024 cmd.exe 202405226a92195e4429fa42c588eb4193d18426virlock.exe PID 3024 wrote to memory of 4536 3024 cmd.exe 202405226a92195e4429fa42c588eb4193d18426virlock.exe PID 3024 wrote to memory of 4536 3024 cmd.exe 202405226a92195e4429fa42c588eb4193d18426virlock.exe PID 872 wrote to memory of 2172 872 cmd.exe cscript.exe PID 872 wrote to memory of 2172 872 cmd.exe cscript.exe PID 872 wrote to memory of 2172 872 cmd.exe cscript.exe PID 4536 wrote to memory of 972 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 4536 wrote to memory of 972 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 4536 wrote to memory of 972 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 972 wrote to memory of 4864 972 cmd.exe 202405226a92195e4429fa42c588eb4193d18426virlock.exe PID 972 wrote to memory of 4864 972 cmd.exe 202405226a92195e4429fa42c588eb4193d18426virlock.exe PID 972 wrote to memory of 4864 972 cmd.exe 202405226a92195e4429fa42c588eb4193d18426virlock.exe PID 4536 wrote to memory of 2560 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4536 wrote to memory of 2560 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4536 wrote to memory of 2560 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4536 wrote to memory of 2304 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4536 wrote to memory of 2304 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4536 wrote to memory of 2304 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4536 wrote to memory of 932 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4536 wrote to memory of 932 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4536 wrote to memory of 932 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4536 wrote to memory of 1276 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 4536 wrote to memory of 1276 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 4536 wrote to memory of 1276 4536 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 1276 wrote to memory of 3560 1276 cmd.exe cscript.exe PID 1276 wrote to memory of 3560 1276 cmd.exe cscript.exe PID 1276 wrote to memory of 3560 1276 cmd.exe cscript.exe PID 4864 wrote to memory of 2900 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 4864 wrote to memory of 2900 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 4864 wrote to memory of 2900 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe PID 2900 wrote to memory of 4872 2900 cmd.exe 202405226a92195e4429fa42c588eb4193d18426virlock.exe PID 2900 wrote to memory of 4872 2900 cmd.exe 202405226a92195e4429fa42c588eb4193d18426virlock.exe PID 2900 wrote to memory of 4872 2900 cmd.exe 202405226a92195e4429fa42c588eb4193d18426virlock.exe PID 4864 wrote to memory of 4744 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4864 wrote to memory of 4744 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4864 wrote to memory of 4744 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4864 wrote to memory of 4708 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4864 wrote to memory of 4708 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4864 wrote to memory of 4708 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4864 wrote to memory of 1856 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4864 wrote to memory of 1856 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4864 wrote to memory of 1856 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe reg.exe PID 4864 wrote to memory of 1840 4864 202405226a92195e4429fa42c588eb4193d18426virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exe"C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\yMwEcscI\ZGYcggIs.exe"C:\Users\Admin\yMwEcscI\ZGYcggIs.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2292 -
C:\ProgramData\XKIEEwoQ\pugEUckk.exe"C:\ProgramData\XKIEEwoQ\pugEUckk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"8⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"10⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"12⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"14⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"16⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"18⤵PID:2332
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"20⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"22⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"24⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"26⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"28⤵PID:1476
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"30⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"32⤵PID:2304
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock33⤵PID:1624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"34⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock35⤵PID:4188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"36⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock37⤵PID:4552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"38⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock39⤵PID:4836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"40⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock41⤵PID:1416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"42⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock43⤵PID:3992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"44⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock45⤵PID:5048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"46⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock47⤵PID:3636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"48⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock49⤵PID:1208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"50⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock51⤵PID:3800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"52⤵PID:64
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock53⤵PID:3396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"54⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock55⤵PID:4712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"56⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock57⤵PID:1692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"58⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock59⤵PID:804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"60⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock61⤵PID:4556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"62⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock63⤵PID:1208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"64⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock65⤵PID:4912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"66⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock67⤵PID:3144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"68⤵PID:1512
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock69⤵PID:4560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"70⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock71⤵PID:3340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"72⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock73⤵PID:876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"74⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock75⤵PID:4404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"76⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock77⤵PID:1176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"78⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock79⤵PID:3560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"80⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock81⤵PID:3488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"82⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock83⤵PID:4056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"84⤵PID:5100
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock85⤵PID:2560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"86⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock87⤵PID:3584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"88⤵PID:64
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock89⤵PID:956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"90⤵PID:1416
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock91⤵PID:972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"92⤵PID:3912
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock93⤵PID:5064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"94⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock95⤵PID:4456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"96⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock97⤵PID:2704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"98⤵PID:3744
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock99⤵PID:2608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"100⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock101⤵PID:4204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"102⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock103⤵PID:2512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"104⤵PID:4872
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock105⤵PID:4504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"106⤵PID:1096
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock107⤵PID:4392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"108⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock109⤵PID:2860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"110⤵PID:428
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock111⤵PID:3800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"112⤵PID:4204
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock113⤵PID:4708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"114⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock115⤵PID:3144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"116⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock117⤵PID:3788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"118⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock119⤵PID:2116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"120⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock121⤵PID:3284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"122⤵PID:3788
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock123⤵PID:4812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"124⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock125⤵PID:4428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"126⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock127⤵PID:4380
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"128⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock129⤵PID:1896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"130⤵PID:428
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1131⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock131⤵PID:536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"132⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock133⤵PID:3468
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"134⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock135⤵PID:1476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"136⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock137⤵PID:2708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"138⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock139⤵PID:1096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"140⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock141⤵PID:2600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"142⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock143⤵PID:620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"144⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock145⤵PID:2600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"146⤵PID:3168
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock147⤵PID:512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"148⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock149⤵PID:2908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"150⤵PID:1912
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock151⤵PID:4376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"152⤵PID:3884
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock153⤵PID:4136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"154⤵PID:2964
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock155⤵PID:3908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"156⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock157⤵PID:3584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"158⤵PID:1096
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1159⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock159⤵PID:620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"160⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock161⤵PID:4456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"162⤵PID:4176
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1163⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock163⤵PID:3992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"164⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock165⤵PID:1540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"166⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock167⤵PID:4836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"168⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock169⤵PID:3552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"170⤵PID:956
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock171⤵PID:3744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"172⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock173⤵PID:648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"174⤵PID:4628
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1175⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock175⤵PID:2512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"176⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock177⤵PID:2692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"178⤵PID:3220
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock179⤵PID:4380
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"180⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock181⤵PID:3992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"182⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock183⤵PID:832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"184⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock185⤵PID:2056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"186⤵PID:320
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock187⤵PID:4556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"188⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock189⤵PID:3552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"190⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock191⤵PID:4056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"192⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock193⤵PID:2260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"194⤵PID:4404
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock195⤵PID:2096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"196⤵PID:1804
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock197⤵PID:4872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"198⤵PID:2708
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1199⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock199⤵PID:876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"200⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock201⤵PID:632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"202⤵PID:3220
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock203⤵PID:4404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"204⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock205⤵PID:1512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"206⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock207⤵PID:3908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"208⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock209⤵PID:3204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"210⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock211⤵PID:3740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"212⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock213⤵PID:4392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"214⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock215⤵PID:2192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"216⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock217⤵PID:4560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"218⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock219⤵PID:2536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"220⤵PID:876
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock221⤵PID:4204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"222⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock223⤵PID:4492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"224⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock225⤵PID:1480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"226⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock227⤵PID:4056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"228⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock229⤵PID:2260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"230⤵PID:3212
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock231⤵PID:388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"232⤵PID:3740
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1233⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock233⤵PID:4652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"234⤵PID:64
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock235⤵PID:4672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"236⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock237⤵PID:1496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"238⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock239⤵PID:2224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock"240⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock.exeC:\Users\Admin\AppData\Local\Temp\202405226a92195e4429fa42c588eb4193d18426virlock241⤵PID:1892
-