Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 08:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe
-
Size
198KB
-
MD5
7981ee8fb5feb1e456a6df731099203f
-
SHA1
d5fbec69da48308b6ffb5cc1cdf50d1856fcaa04
-
SHA256
446c557908ba8220c60a45d9d3aa66243ce00f7bdeddd96b5300569c488aa992
-
SHA512
965ced38c95ca1f6cdecd7d1b2c91a7cde44275e2391218f38756c19d100a0eaea04fcee6c762ead50337a84547378a27549cd4e4ab73f3bbff6aead56d7746c
-
SSDEEP
3072:psonHfdGxWSSETyIZQnxTTuZAT73LY/qvg4sBd:p5yE9hJqZA33Tad
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (61) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bAwEcMok.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation bAwEcMok.exe -
Executes dropped EXE 2 IoCs
Processes:
bAwEcMok.exeFQMIoUkE.exepid process 3052 bAwEcMok.exe 2540 FQMIoUkE.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exebAwEcMok.exepid process 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
bAwEcMok.exeFQMIoUkE.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\bAwEcMok.exe = "C:\\Users\\Admin\\CCsQEEoQ\\bAwEcMok.exe" bAwEcMok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FQMIoUkE.exe = "C:\\ProgramData\\uGokMUgE\\FQMIoUkE.exe" FQMIoUkE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\bAwEcMok.exe = "C:\\Users\\Admin\\CCsQEEoQ\\bAwEcMok.exe" 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FQMIoUkE.exe = "C:\\ProgramData\\uGokMUgE\\FQMIoUkE.exe" 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2332 reg.exe 2560 reg.exe 2156 reg.exe 1472 reg.exe 2460 reg.exe 2088 reg.exe 1296 reg.exe 1540 reg.exe 644 reg.exe 2496 reg.exe 1508 reg.exe 2300 reg.exe 3056 reg.exe 2392 reg.exe 2624 reg.exe 1660 reg.exe 1168 reg.exe 2396 reg.exe 2520 reg.exe 2196 reg.exe 496 reg.exe 1500 reg.exe 1036 reg.exe 1540 reg.exe 2472 reg.exe 2300 reg.exe 3056 reg.exe 1984 reg.exe 2692 reg.exe 3000 reg.exe 2748 reg.exe 2288 reg.exe 2796 reg.exe 1716 reg.exe 2796 reg.exe 576 reg.exe 880 reg.exe 2128 reg.exe 1924 reg.exe 2572 reg.exe 1168 reg.exe 2244 reg.exe 1904 reg.exe 592 reg.exe 644 reg.exe 2708 reg.exe 1988 reg.exe 2900 reg.exe 2028 reg.exe 2716 reg.exe 2536 reg.exe 2680 reg.exe 324 reg.exe 2724 reg.exe 108 reg.exe 2404 reg.exe 2764 reg.exe 404 reg.exe 2148 reg.exe 1908 reg.exe 1364 reg.exe 2288 reg.exe 2016 reg.exe 2436 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exepid process 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2688 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2688 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1908 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1908 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 488 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 488 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1000 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1000 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 892 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 892 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2340 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2340 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1924 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1924 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2680 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2680 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1800 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1800 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 708 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 708 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2724 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2724 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2420 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2420 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2556 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2556 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2068 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2068 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2084 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2084 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1796 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1796 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1536 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1536 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1616 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1616 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1736 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1736 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2108 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2108 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1636 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1636 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2680 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2680 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1012 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1012 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2628 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2628 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1920 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1920 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2172 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2172 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1412 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1412 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1080 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 1080 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2476 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2476 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2820 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe 2820 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
bAwEcMok.exepid process 3052 bAwEcMok.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
bAwEcMok.exepid process 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe 3052 bAwEcMok.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.execmd.execmd.exe2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.execmd.execmd.exedescription pid process target process PID 2324 wrote to memory of 3052 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe bAwEcMok.exe PID 2324 wrote to memory of 3052 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe bAwEcMok.exe PID 2324 wrote to memory of 3052 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe bAwEcMok.exe PID 2324 wrote to memory of 3052 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe bAwEcMok.exe PID 2324 wrote to memory of 2540 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe FQMIoUkE.exe PID 2324 wrote to memory of 2540 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe FQMIoUkE.exe PID 2324 wrote to memory of 2540 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe FQMIoUkE.exe PID 2324 wrote to memory of 2540 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe FQMIoUkE.exe PID 2324 wrote to memory of 2732 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 2324 wrote to memory of 2732 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 2324 wrote to memory of 2732 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 2324 wrote to memory of 2732 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 2732 wrote to memory of 872 2732 cmd.exe 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe PID 2732 wrote to memory of 872 2732 cmd.exe 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe PID 2732 wrote to memory of 872 2732 cmd.exe 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe PID 2732 wrote to memory of 872 2732 cmd.exe 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe PID 2324 wrote to memory of 2692 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2692 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2692 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2692 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2480 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2480 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2480 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2480 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2580 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2580 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2580 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2580 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 2324 wrote to memory of 2388 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 2324 wrote to memory of 2388 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 2324 wrote to memory of 2388 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 2324 wrote to memory of 2388 2324 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 2388 wrote to memory of 1664 2388 cmd.exe cscript.exe PID 2388 wrote to memory of 1664 2388 cmd.exe cscript.exe PID 2388 wrote to memory of 1664 2388 cmd.exe cscript.exe PID 2388 wrote to memory of 1664 2388 cmd.exe cscript.exe PID 872 wrote to memory of 2376 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 872 wrote to memory of 2376 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 872 wrote to memory of 2376 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 872 wrote to memory of 2376 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 2376 wrote to memory of 2688 2376 cmd.exe 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe PID 2376 wrote to memory of 2688 2376 cmd.exe 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe PID 2376 wrote to memory of 2688 2376 cmd.exe 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe PID 2376 wrote to memory of 2688 2376 cmd.exe 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe PID 872 wrote to memory of 1548 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 1548 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 1548 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 1548 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 2320 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 2320 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 2320 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 2320 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 2704 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 2704 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 2704 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 2704 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe reg.exe PID 872 wrote to memory of 1948 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 872 wrote to memory of 1948 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 872 wrote to memory of 1948 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 872 wrote to memory of 1948 872 2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe cmd.exe PID 1948 wrote to memory of 2284 1948 cmd.exe cscript.exe PID 1948 wrote to memory of 2284 1948 cmd.exe cscript.exe PID 1948 wrote to memory of 2284 1948 cmd.exe cscript.exe PID 1948 wrote to memory of 2284 1948 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\CCsQEEoQ\bAwEcMok.exe"C:\Users\Admin\CCsQEEoQ\bAwEcMok.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3052 -
C:\ProgramData\uGokMUgE\FQMIoUkE.exe"C:\ProgramData\uGokMUgE\FQMIoUkE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2540 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2688 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"6⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1908 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"8⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:488 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"10⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1000 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"12⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:892 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"14⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2340 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"16⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"18⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2680 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"20⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1800 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"22⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:708 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"24⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"26⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2420 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"28⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"30⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2068 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"32⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2084 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"34⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"36⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"38⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"40⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:1736 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"42⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:2108 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"44⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:1636 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"46⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:2680 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"48⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:1012 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"50⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2628 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"52⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"54⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:2172 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"56⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1412 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"58⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:1080 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"60⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2476 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"62⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2820 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"64⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock65⤵PID:2804
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"66⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock67⤵PID:2652
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"68⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock69⤵PID:1716
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"70⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock71⤵PID:288
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"72⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock73⤵PID:1200
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"74⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock75⤵PID:404
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"76⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock77⤵PID:2124
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"78⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock79⤵PID:1284
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"80⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock81⤵PID:3044
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"82⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock83⤵PID:1008
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"84⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock85⤵PID:604
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"86⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock87⤵PID:1872
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"88⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock89⤵PID:784
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"90⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock91⤵PID:1756
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"92⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock93⤵PID:1376
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"94⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock95⤵PID:2652
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"96⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock97⤵PID:3020
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"98⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock99⤵PID:2644
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"100⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock101⤵PID:2732
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"102⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock103⤵PID:2472
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"104⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock105⤵PID:2064
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"106⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock107⤵PID:2156
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"108⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock109⤵PID:2244
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"110⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock111⤵PID:2468
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"112⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock113⤵PID:784
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"114⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock115⤵PID:2052
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"116⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock117⤵PID:1720
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"118⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock119⤵PID:1332
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"120⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock121⤵PID:1796
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"122⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock123⤵PID:2780
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"124⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock125⤵PID:1368
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"126⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock127⤵PID:1380
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"128⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock129⤵PID:1724
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"130⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock131⤵PID:2112
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"132⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock133⤵PID:1572
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"134⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock135⤵PID:268
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"136⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock137⤵PID:2140
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"138⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock139⤵PID:2872
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"140⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock141⤵PID:2712
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"142⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock143⤵PID:768
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"144⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock145⤵PID:2112
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"146⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock147⤵PID:2288
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"148⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock149⤵PID:848
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"150⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock151⤵PID:2688
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"152⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock153⤵PID:1284
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"154⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock155⤵PID:2536
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"156⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock157⤵PID:3064
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"158⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock159⤵PID:1860
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"160⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock161⤵PID:2468
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"162⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock163⤵PID:2288
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"164⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock165⤵PID:2500
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"166⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock167⤵PID:276
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"168⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock169⤵PID:2836
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"170⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock171⤵PID:112
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"172⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock173⤵PID:1752
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"174⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock175⤵PID:584
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"176⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock177⤵PID:1872
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"178⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock179⤵PID:2148
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"180⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock181⤵PID:2416
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"182⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock183⤵PID:924
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"184⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock185⤵PID:2112
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"186⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock187⤵PID:916
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"188⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock189⤵PID:2616
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"190⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock191⤵PID:2064
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"192⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock193⤵PID:2880
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"194⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock195⤵PID:1256
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"196⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock197⤵PID:1760
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"198⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock199⤵PID:1544
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"200⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock201⤵PID:2512
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"202⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock203⤵PID:2612
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"204⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock205⤵PID:2332
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"206⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock207⤵PID:2180
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"208⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock209⤵PID:2016
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"210⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock211⤵PID:1740
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"212⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock213⤵PID:1512
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"214⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock215⤵PID:2284
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"216⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock217⤵PID:2084
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"218⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock219⤵PID:2588
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"220⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock221⤵PID:2664
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"222⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock223⤵PID:1312
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"224⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock225⤵PID:356
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"226⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock227⤵PID:288
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"228⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock229⤵PID:1332
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"230⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock231⤵PID:2940
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"232⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock233⤵PID:1480
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"234⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock235⤵PID:820
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"236⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock237⤵PID:3068
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"238⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock239⤵PID:496
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock"240⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_7981ee8fb5feb1e456a6df731099203f_virlock241⤵PID:2732
-