Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 10:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe
-
Size
268KB
-
MD5
156c0c82cc6ec79b5e510a32ffb4c320
-
SHA1
3fba51da6a341e3d4d75342de7bf0765e2fe5fed
-
SHA256
80363080de8ff10d5702532b3e1cb112b848f12cb21608fc4868cc2ae8a1303a
-
SHA512
8d636830f305bba2c35b863a8138ac946be8f1278344c22c207fc1bb25391d13024379e7cca98c4848831be54de2ad05432d1cbf725e408db4cee9a2a2e76b58
-
SSDEEP
6144:fI5amBA/dOi5QBF12xiBS8HP3MHlqngE:g5XB8D5QBF1fU8HfMFqgE
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" -
Renames multiple (78) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wUAkMQgA.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation wUAkMQgA.exe -
Executes dropped EXE 2 IoCs
Processes:
wUAkMQgA.exeQgcssskU.exepid process 4928 wUAkMQgA.exe 1644 QgcssskU.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exewUAkMQgA.exeQgcssskU.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wUAkMQgA.exe = "C:\\Users\\Admin\\IQosogMY\\wUAkMQgA.exe" 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QgcssskU.exe = "C:\\ProgramData\\hYkEgIME\\QgcssskU.exe" 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wUAkMQgA.exe = "C:\\Users\\Admin\\IQosogMY\\wUAkMQgA.exe" wUAkMQgA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QgcssskU.exe = "C:\\ProgramData\\hYkEgIME\\QgcssskU.exe" QgcssskU.exe -
Drops file in System32 directory 2 IoCs
Processes:
wUAkMQgA.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe wUAkMQgA.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe wUAkMQgA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 3872 reg.exe 396 reg.exe 3692 reg.exe 3972 reg.exe 648 reg.exe 3396 636 reg.exe 4848 reg.exe 4088 reg.exe 4920 220 1696 reg.exe 1336 reg.exe 3360 4308 reg.exe 4732 reg.exe 2572 reg.exe 60 reg.exe 2992 reg.exe 1936 reg.exe 2128 reg.exe 2064 reg.exe 1548 reg.exe 2480 5092 reg.exe 5096 reg.exe 64 reg.exe 4720 reg.exe 728 reg.exe 3460 reg.exe 2996 reg.exe 3124 reg.exe 1392 reg.exe 548 2072 3960 reg.exe 2148 reg.exe 3488 reg.exe 2560 2148 reg.exe 2224 reg.exe 772 1288 reg.exe 908 3960 reg.exe 3396 reg.exe 1352 reg.exe 1584 reg.exe 1776 reg.exe 4164 1036 reg.exe 3488 reg.exe 2224 reg.exe 3628 reg.exe 808 reg.exe 1568 reg.exe 3076 reg.exe 4632 reg.exe 748 reg.exe 4980 reg.exe 1788 reg.exe 4608 reg.exe 1152 reg.exe 64 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exepid process 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4272 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4272 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4272 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4272 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3204 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3204 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3204 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3204 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3300 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3300 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3300 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3300 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1536 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1536 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1536 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 1536 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4024 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4024 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4024 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4024 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4040 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4040 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4040 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4040 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2324 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2324 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2324 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2324 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2812 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2812 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2812 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2812 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2556 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2556 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2556 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2556 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4024 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4024 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4024 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4024 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4676 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4676 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4676 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 4676 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2596 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2596 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2596 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe 2596 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
wUAkMQgA.exepid process 4928 wUAkMQgA.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
wUAkMQgA.exepid process 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe 4928 wUAkMQgA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.execmd.execmd.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.execmd.execmd.exe2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.execmd.exedescription pid process target process PID 4012 wrote to memory of 4928 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe wUAkMQgA.exe PID 4012 wrote to memory of 4928 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe wUAkMQgA.exe PID 4012 wrote to memory of 4928 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe wUAkMQgA.exe PID 4012 wrote to memory of 1644 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe QgcssskU.exe PID 4012 wrote to memory of 1644 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe QgcssskU.exe PID 4012 wrote to memory of 1644 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe QgcssskU.exe PID 4012 wrote to memory of 1400 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 4012 wrote to memory of 1400 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 4012 wrote to memory of 1400 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1400 wrote to memory of 3280 1400 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 1400 wrote to memory of 3280 1400 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 1400 wrote to memory of 3280 1400 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 4012 wrote to memory of 748 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 4012 wrote to memory of 748 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 4012 wrote to memory of 748 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 4012 wrote to memory of 4224 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 4012 wrote to memory of 4224 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 4012 wrote to memory of 4224 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 4012 wrote to memory of 396 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 4012 wrote to memory of 396 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 4012 wrote to memory of 396 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 4012 wrote to memory of 1084 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 4012 wrote to memory of 1084 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 4012 wrote to memory of 1084 4012 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1084 wrote to memory of 4532 1084 cmd.exe cscript.exe PID 1084 wrote to memory of 4532 1084 cmd.exe cscript.exe PID 1084 wrote to memory of 4532 1084 cmd.exe cscript.exe PID 3280 wrote to memory of 392 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 3280 wrote to memory of 392 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 3280 wrote to memory of 392 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 3280 wrote to memory of 3404 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 3280 wrote to memory of 3404 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 3280 wrote to memory of 3404 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 3280 wrote to memory of 3504 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 3280 wrote to memory of 3504 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 3280 wrote to memory of 3504 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 3280 wrote to memory of 1540 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 3280 wrote to memory of 1540 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 3280 wrote to memory of 1540 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 3280 wrote to memory of 4108 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 3280 wrote to memory of 4108 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 3280 wrote to memory of 4108 3280 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 392 wrote to memory of 1612 392 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 392 wrote to memory of 1612 392 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 392 wrote to memory of 1612 392 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 4108 wrote to memory of 3532 4108 cmd.exe cscript.exe PID 4108 wrote to memory of 3532 4108 cmd.exe cscript.exe PID 4108 wrote to memory of 3532 4108 cmd.exe cscript.exe PID 1612 wrote to memory of 728 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1612 wrote to memory of 728 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 1612 wrote to memory of 728 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe PID 728 wrote to memory of 4272 728 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 728 wrote to memory of 4272 728 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 728 wrote to memory of 4272 728 cmd.exe 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe PID 1612 wrote to memory of 4228 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1612 wrote to memory of 4228 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1612 wrote to memory of 4228 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1612 wrote to memory of 1820 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1612 wrote to memory of 1820 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1612 wrote to memory of 1820 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1612 wrote to memory of 1036 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1612 wrote to memory of 1036 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1612 wrote to memory of 1036 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe reg.exe PID 1612 wrote to memory of 2120 1612 2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\IQosogMY\wUAkMQgA.exe"C:\Users\Admin\IQosogMY\wUAkMQgA.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4928 -
C:\ProgramData\hYkEgIME\QgcssskU.exe"C:\ProgramData\hYkEgIME\QgcssskU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"8⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"10⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"12⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"14⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"16⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:4024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"18⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"20⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"22⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"24⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"26⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:4024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"28⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"30⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"32⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock33⤵PID:540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"34⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock35⤵PID:4808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"36⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock37⤵PID:4976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"38⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock39⤵PID:1612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"40⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock41⤵PID:860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"42⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock43⤵PID:3432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"44⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock45⤵PID:4228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"46⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock47⤵PID:516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"48⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock49⤵PID:4656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"50⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock51⤵PID:2688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"52⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock53⤵PID:1768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"54⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock55⤵PID:4512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"56⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock57⤵PID:3432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"58⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock59⤵PID:3120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"60⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock61⤵PID:1412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"62⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock63⤵PID:1956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"64⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock65⤵PID:1120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"66⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock67⤵PID:1696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"68⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock69⤵PID:3580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"70⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock71⤵PID:2072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"72⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock73⤵PID:1804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"74⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock75⤵PID:2516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"76⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock77⤵PID:3152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"78⤵PID:1352
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock79⤵PID:60
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"80⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock81⤵PID:3520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"82⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock83⤵PID:1548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"84⤵PID:1888
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock85⤵PID:3120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"86⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock87⤵PID:2556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"88⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock89⤵PID:2396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"90⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock91⤵PID:3220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"92⤵PID:1776
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock93⤵PID:4420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"94⤵PID:4164
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock95⤵PID:4848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"96⤵PID:3612
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock97⤵PID:1444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"98⤵PID:4992
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock99⤵PID:3360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"100⤵PID:4856
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock101⤵PID:1400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"102⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock103⤵PID:4512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"104⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock105⤵PID:2032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"106⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock107⤵PID:2620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"108⤵PID:1612
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock109⤵PID:1968
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"110⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock111⤵PID:1412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"112⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock113⤵PID:1980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"114⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock115⤵PID:4692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"116⤵PID:4368
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock117⤵PID:2760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"118⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock119⤵PID:3212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"120⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock121⤵PID:1788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"122⤵PID:3820
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock123⤵PID:1120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"124⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock125⤵PID:2476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"126⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock127⤵PID:2464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"128⤵PID:400
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock129⤵PID:4632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"130⤵PID:2856
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1131⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock131⤵PID:5096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"132⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock133⤵PID:3568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"134⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock135⤵PID:776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"136⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock137⤵PID:4632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"138⤵PID:60
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1139⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock139⤵PID:4672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"140⤵PID:2396
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1141⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock141⤵PID:452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"142⤵PID:3520
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1143⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock143⤵PID:776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"144⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock145⤵PID:412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"146⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock147⤵PID:520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"148⤵PID:2532
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1149⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock149⤵PID:2148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"150⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock151⤵PID:4012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"152⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock153⤵PID:4052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"154⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock155⤵PID:2724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"156⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock157⤵PID:3428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"158⤵PID:1400
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1159⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock159⤵PID:3348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"160⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock161⤵PID:4384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"162⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock163⤵PID:520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"164⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock165⤵PID:1904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"166⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock167⤵PID:4848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"168⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock169⤵PID:4692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"170⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock171⤵PID:1488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"172⤵PID:412
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1173⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock173⤵PID:4184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"174⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock175⤵PID:3320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"176⤵PID:4508
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1177⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock177⤵PID:2720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"178⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock179⤵PID:3820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"180⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock181⤵PID:1056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"182⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock183⤵PID:3588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"184⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock185⤵PID:1924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"186⤵PID:1808
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock187⤵PID:1612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"188⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock189⤵PID:2792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"190⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock191⤵PID:776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"192⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock193⤵PID:4436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"194⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock195⤵PID:2464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"196⤵PID:2592
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock197⤵PID:1392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"198⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock199⤵PID:1888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"200⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock201⤵PID:2792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"202⤵PID:2480
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock203⤵PID:3428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"204⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock205⤵PID:3520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"206⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock207⤵PID:2160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"208⤵PID:2760
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock209⤵PID:60
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"210⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock211⤵PID:1548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"212⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock213⤵PID:3808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"214⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock215⤵PID:2804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"216⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock217⤵PID:4632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"218⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock219⤵PID:1980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"220⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock221⤵PID:4896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"222⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock223⤵PID:2224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"224⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock225⤵PID:1352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"226⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock227⤵PID:1056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"228⤵PID:712
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1229⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock229⤵PID:4952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"230⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock231⤵PID:2556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"232⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock233⤵PID:60
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"234⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock235⤵PID:908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"236⤵PID:3588
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1237⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock237⤵PID:3576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"238⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock239⤵PID:3216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock"240⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_156c0c82cc6ec79b5e510a32ffb4c320_virlock241⤵PID:64
-