Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 18:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe
-
Size
206KB
-
MD5
10651c37469a05dca5c5dd5ad3b7c830
-
SHA1
8d629731228658bc85fe8110992a3befcb772130
-
SHA256
1d96ce6eef0d47ba0dd3b0d7205ba1ab16533cdab176ea9ca81d8d7807ae6a6c
-
SHA512
55bf0ead82a8942fdd7e7ee1a51a0ff5cf4e0e187e0fed2465a429ea3d6917099469d56d22ad125bbb71dd2880f3dd82ade40c64559b2a70eb729dd595bef24b
-
SSDEEP
3072:wbCFEsbDdXH6N7UZVPuT9RRNfJ0WQDdsWJqO4Y41KgDbrzvDLtI:ZSUKyVc8d/JqH7sgvDLy
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (57) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NKMsAgUM.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation NKMsAgUM.exe -
Executes dropped EXE 2 IoCs
Processes:
NKMsAgUM.exevgsosokM.exepid process 1284 NKMsAgUM.exe 2692 vgsosokM.exe -
Loads dropped DLL 20 IoCs
Processes:
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeNKMsAgUM.exepid process 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeNKMsAgUM.exevgsosokM.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\NKMsAgUM.exe = "C:\\Users\\Admin\\bgAEwYIU\\NKMsAgUM.exe" 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vgsosokM.exe = "C:\\ProgramData\\aqAMAoss\\vgsosokM.exe" 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\NKMsAgUM.exe = "C:\\Users\\Admin\\bgAEwYIU\\NKMsAgUM.exe" NKMsAgUM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vgsosokM.exe = "C:\\ProgramData\\aqAMAoss\\vgsosokM.exe" vgsosokM.exe -
Drops file in Windows directory 1 IoCs
Processes:
NKMsAgUM.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico NKMsAgUM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 2928 reg.exe 2596 reg.exe 1080 reg.exe 2468 reg.exe 596 reg.exe 1524 reg.exe 2580 reg.exe 2184 reg.exe 2364 reg.exe 1660 reg.exe 2016 reg.exe 2512 reg.exe 668 reg.exe 1172 reg.exe 2268 reg.exe 1936 reg.exe 1272 reg.exe 608 reg.exe 668 reg.exe 1616 reg.exe 2148 reg.exe 2724 reg.exe 608 reg.exe 2528 reg.exe 2524 reg.exe 2292 reg.exe 2216 reg.exe 772 reg.exe 2296 reg.exe 2800 reg.exe 2008 reg.exe 3064 reg.exe 3048 reg.exe 2096 reg.exe 2296 reg.exe 2200 reg.exe 2040 reg.exe 2556 reg.exe 1396 reg.exe 920 reg.exe 2968 reg.exe 1080 reg.exe 2688 reg.exe 2388 reg.exe 2672 reg.exe 2488 reg.exe 2260 reg.exe 1256 reg.exe 832 reg.exe 2168 reg.exe 2796 reg.exe 1576 reg.exe 2668 reg.exe 2672 reg.exe 1672 reg.exe 2384 reg.exe 2256 reg.exe 2384 reg.exe 2680 reg.exe 2128 reg.exe 1900 reg.exe 2472 reg.exe 776 reg.exe 1716 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exepid process 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2364 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2364 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2328 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2328 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 336 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1652 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1652 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2360 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2360 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2024 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2024 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 912 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 912 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1716 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1716 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2072 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2072 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1512 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1512 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2828 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2828 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 892 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 892 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2548 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2548 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2120 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2120 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1728 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1728 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2780 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2780 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 712 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 712 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1888 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1888 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2808 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2808 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 896 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 896 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2636 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2636 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3044 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3044 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1560 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1560 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3032 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 3032 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2172 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2172 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1236 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 1236 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 452 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 452 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2972 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2972 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 828 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 828 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2588 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe 2588 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
NKMsAgUM.exepid process 1284 NKMsAgUM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
NKMsAgUM.exepid process 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe 1284 NKMsAgUM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.execmd.execmd.exe2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.execmd.execmd.exedescription pid process target process PID 1964 wrote to memory of 1284 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe NKMsAgUM.exe PID 1964 wrote to memory of 1284 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe NKMsAgUM.exe PID 1964 wrote to memory of 1284 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe NKMsAgUM.exe PID 1964 wrote to memory of 1284 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe NKMsAgUM.exe PID 1964 wrote to memory of 2692 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe vgsosokM.exe PID 1964 wrote to memory of 2692 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe vgsosokM.exe PID 1964 wrote to memory of 2692 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe vgsosokM.exe PID 1964 wrote to memory of 2692 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe vgsosokM.exe PID 1964 wrote to memory of 2656 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 1964 wrote to memory of 2656 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 1964 wrote to memory of 2656 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 1964 wrote to memory of 2656 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 2656 wrote to memory of 2568 2656 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 2656 wrote to memory of 2568 2656 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 2656 wrote to memory of 2568 2656 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 2656 wrote to memory of 2568 2656 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 1964 wrote to memory of 2416 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2416 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2416 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2416 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2908 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2908 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2908 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2908 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2680 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2680 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2680 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2680 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 1964 wrote to memory of 2432 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 1964 wrote to memory of 2432 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 1964 wrote to memory of 2432 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 1964 wrote to memory of 2432 1964 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 2432 wrote to memory of 2864 2432 cmd.exe cscript.exe PID 2432 wrote to memory of 2864 2432 cmd.exe cscript.exe PID 2432 wrote to memory of 2864 2432 cmd.exe cscript.exe PID 2432 wrote to memory of 2864 2432 cmd.exe cscript.exe PID 2568 wrote to memory of 3036 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 2568 wrote to memory of 3036 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 2568 wrote to memory of 3036 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 2568 wrote to memory of 3036 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 3036 wrote to memory of 2364 3036 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 3036 wrote to memory of 2364 3036 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 3036 wrote to memory of 2364 3036 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 3036 wrote to memory of 2364 3036 cmd.exe 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe PID 2568 wrote to memory of 1612 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 1612 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 1612 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 1612 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 776 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 776 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 776 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 776 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 2468 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 2468 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 2468 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 2468 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe reg.exe PID 2568 wrote to memory of 1044 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 2568 wrote to memory of 1044 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 2568 wrote to memory of 1044 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 2568 wrote to memory of 1044 2568 2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe cmd.exe PID 1044 wrote to memory of 1584 1044 cmd.exe cscript.exe PID 1044 wrote to memory of 1584 1044 cmd.exe cscript.exe PID 1044 wrote to memory of 1584 1044 cmd.exe cscript.exe PID 1044 wrote to memory of 1584 1044 cmd.exe cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\bgAEwYIU\NKMsAgUM.exe"C:\Users\Admin\bgAEwYIU\NKMsAgUM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1284 -
C:\ProgramData\aqAMAoss\vgsosokM.exe"C:\ProgramData\aqAMAoss\vgsosokM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2692 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2364 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"6⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2328 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"8⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:336 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"10⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"12⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:2360 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"14⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2024 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"16⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:912 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"18⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"20⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2072 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"22⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"24⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2828 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"26⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:892 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"28⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2548 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"30⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2120 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"32⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"34⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:2780 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"36⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:712 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"38⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"40⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2808 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"42⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:896 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"44⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2636 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"46⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"48⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:1560 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"50⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:3032 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"52⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2172 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"54⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:1236 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"56⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:452 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"58⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"60⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:828 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"62⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2588 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"64⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock65⤵PID:776
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"66⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock67⤵PID:2808
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"68⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock69⤵PID:2256
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"70⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock71⤵PID:1768
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"72⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock73⤵PID:2972
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"74⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock75⤵PID:2532
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"76⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock77⤵PID:2452
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"78⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock79⤵PID:2700
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"80⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock81⤵PID:1176
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"82⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock83⤵PID:2084
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"84⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock85⤵PID:1140
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"86⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock87⤵PID:2740
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"88⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock89⤵PID:1496
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"90⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock91⤵PID:1584
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"92⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock93⤵PID:1464
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"94⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock95⤵PID:2240
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"96⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock97⤵PID:2268
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"98⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock99⤵PID:2028
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"100⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock101⤵PID:2616
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"102⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock103⤵PID:2208
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"104⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock105⤵PID:2004
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"106⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock107⤵PID:892
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"108⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock109⤵PID:2716
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"110⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock111⤵PID:2764
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"112⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock113⤵PID:1524
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"114⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock115⤵PID:1556
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"116⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock117⤵PID:2628
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"118⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock119⤵PID:2708
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"120⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock121⤵PID:692
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"122⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock123⤵PID:2764
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"124⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock125⤵PID:2952
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"126⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock127⤵PID:2296
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"128⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock129⤵PID:2844
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"130⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock131⤵PID:1556
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"132⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock133⤵PID:1584
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"134⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock135⤵PID:2688
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"136⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock137⤵PID:2760
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"138⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock139⤵PID:2268
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"140⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock141⤵PID:108
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"142⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock143⤵PID:1252
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"144⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock145⤵PID:1664
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"146⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock147⤵PID:716
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"148⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock149⤵PID:3064
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"150⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock151⤵PID:920
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"152⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock153⤵PID:2888
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"154⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock155⤵PID:2404
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"156⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock157⤵PID:2552
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"158⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock159⤵PID:1820
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"160⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock161⤵PID:2508
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"162⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock163⤵PID:2920
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"164⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock165⤵PID:2720
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"166⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock167⤵PID:572
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"168⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock169⤵PID:2428
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"170⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock171⤵PID:1616
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"172⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock173⤵PID:2436
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"174⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock175⤵PID:2200
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"176⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock177⤵PID:1564
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"178⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock179⤵PID:832
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"180⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock181⤵PID:912
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"182⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock183⤵PID:2388
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"184⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock185⤵PID:2836
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"186⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock187⤵PID:1960
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"188⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock189⤵PID:1012
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"190⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock191⤵PID:2560
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"192⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock193⤵PID:1580
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"194⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock195⤵PID:2248
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"196⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock197⤵PID:1348
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"198⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock199⤵PID:1280
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"200⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock201⤵PID:2120
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"202⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock203⤵PID:2768
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"204⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock205⤵PID:2360
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"206⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock207⤵PID:1900
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"208⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock209⤵PID:2344
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"210⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock211⤵PID:1772
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"212⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock213⤵PID:2340
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"214⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock215⤵PID:1512
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"216⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock217⤵PID:1040
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"218⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock219⤵PID:2836
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"220⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock221⤵PID:1232
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"222⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock223⤵PID:2312
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"224⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock225⤵PID:1140
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"226⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock227⤵PID:2792
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"228⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock229⤵PID:1744
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"230⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock231⤵PID:1792
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"232⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock233⤵PID:1620
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"234⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock235⤵PID:336
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"236⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock237⤵PID:2488
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"238⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock239⤵PID:2420
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock"240⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_10651c37469a05dca5c5dd5ad3b7c830_virlock241⤵PID:1860
-