Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 11:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe
-
Size
185KB
-
MD5
1803e61f2f3642ff828ed67ef87f2ac3
-
SHA1
a583696ef62a777db8bda831b534788875774237
-
SHA256
703f5ad176aeca11852b2844e17de901ba022e714484e3208408b8e915ff23b4
-
SHA512
cafdfec6a55cc596d78ae8b8d85583aa7de29fcdb380186812f4eedbb671718a563b2c23e75e823d5746edfff997d34c609eae091564547f238aca980c143cd3
-
SSDEEP
3072:3wVPKOlgM4g637M3G1wm3XFk1nZ5alX/EqN1cLvuOabxAO/nRNjY557JdiCq:gVyOlgM4gg7M3G73XFk1nZ5alXc1TO/f
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (65) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation cmcMMYQI.exe -
Executes dropped EXE 2 IoCs
pid Process 2188 cmcMMYQI.exe 2288 jokkYoUw.exe -
Loads dropped DLL 20 IoCs
pid Process 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmcMMYQI.exe = "C:\\Users\\Admin\\FmksoIAM\\cmcMMYQI.exe" 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jokkYoUw.exe = "C:\\ProgramData\\LyMQcUUM\\jokkYoUw.exe" 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmcMMYQI.exe = "C:\\Users\\Admin\\FmksoIAM\\cmcMMYQI.exe" cmcMMYQI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jokkYoUw.exe = "C:\\ProgramData\\LyMQcUUM\\jokkYoUw.exe" jokkYoUw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 1584 reg.exe 2056 reg.exe 2720 reg.exe 2272 reg.exe 1584 reg.exe 1592 reg.exe 2192 reg.exe 2764 reg.exe 2660 reg.exe 1340 reg.exe 1600 reg.exe 1000 reg.exe 2900 reg.exe 2752 reg.exe 448 reg.exe 2684 reg.exe 2500 reg.exe 2640 reg.exe 1500 reg.exe 1772 reg.exe 336 reg.exe 1908 reg.exe 1192 reg.exe 1304 reg.exe 2420 reg.exe 2724 reg.exe 1032 reg.exe 1568 reg.exe 1248 reg.exe 820 reg.exe 1632 reg.exe 700 reg.exe 1680 reg.exe 2964 reg.exe 1944 reg.exe 1864 reg.exe 2880 reg.exe 2536 reg.exe 1564 reg.exe 1596 reg.exe 2400 reg.exe 2080 reg.exe 1652 reg.exe 336 reg.exe 2652 reg.exe 2648 reg.exe 1644 reg.exe 2356 reg.exe 2524 reg.exe 1544 reg.exe 2352 reg.exe 1740 reg.exe 1248 reg.exe 2860 reg.exe 2940 reg.exe 2704 reg.exe 780 reg.exe 472 reg.exe 1856 reg.exe 596 reg.exe 1936 reg.exe 1780 reg.exe 2080 reg.exe 2080 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1724 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1724 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2736 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2736 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2108 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2108 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1656 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1656 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2984 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2984 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2548 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2548 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1140 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1140 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1444 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1444 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2420 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2420 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1816 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1816 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2012 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2012 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2444 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2444 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2548 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2548 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2616 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2616 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 308 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 308 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1568 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1568 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2612 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2612 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2220 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2220 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2460 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2460 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1312 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1312 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2616 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2616 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2336 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2336 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2352 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2352 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2844 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2844 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1036 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1036 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2416 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2416 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1496 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1496 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1644 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 1644 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2592 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2592 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2704 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 2704 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2188 cmcMMYQI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe 2188 cmcMMYQI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2188 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 28 PID 2184 wrote to memory of 2188 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 28 PID 2184 wrote to memory of 2188 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 28 PID 2184 wrote to memory of 2188 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 28 PID 2184 wrote to memory of 2288 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 29 PID 2184 wrote to memory of 2288 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 29 PID 2184 wrote to memory of 2288 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 29 PID 2184 wrote to memory of 2288 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 29 PID 2184 wrote to memory of 2864 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 30 PID 2184 wrote to memory of 2864 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 30 PID 2184 wrote to memory of 2864 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 30 PID 2184 wrote to memory of 2864 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 30 PID 2864 wrote to memory of 2640 2864 cmd.exe 32 PID 2864 wrote to memory of 2640 2864 cmd.exe 32 PID 2864 wrote to memory of 2640 2864 cmd.exe 32 PID 2864 wrote to memory of 2640 2864 cmd.exe 32 PID 2184 wrote to memory of 2624 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 33 PID 2184 wrote to memory of 2624 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 33 PID 2184 wrote to memory of 2624 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 33 PID 2184 wrote to memory of 2624 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 33 PID 2184 wrote to memory of 2860 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 35 PID 2184 wrote to memory of 2860 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 35 PID 2184 wrote to memory of 2860 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 35 PID 2184 wrote to memory of 2860 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 35 PID 2184 wrote to memory of 2576 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 36 PID 2184 wrote to memory of 2576 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 36 PID 2184 wrote to memory of 2576 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 36 PID 2184 wrote to memory of 2576 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 36 PID 2184 wrote to memory of 2596 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 39 PID 2184 wrote to memory of 2596 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 39 PID 2184 wrote to memory of 2596 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 39 PID 2184 wrote to memory of 2596 2184 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 39 PID 2596 wrote to memory of 2452 2596 cmd.exe 41 PID 2596 wrote to memory of 2452 2596 cmd.exe 41 PID 2596 wrote to memory of 2452 2596 cmd.exe 41 PID 2596 wrote to memory of 2452 2596 cmd.exe 41 PID 2640 wrote to memory of 2992 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 42 PID 2640 wrote to memory of 2992 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 42 PID 2640 wrote to memory of 2992 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 42 PID 2640 wrote to memory of 2992 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 42 PID 2992 wrote to memory of 1724 2992 cmd.exe 44 PID 2992 wrote to memory of 1724 2992 cmd.exe 44 PID 2992 wrote to memory of 1724 2992 cmd.exe 44 PID 2992 wrote to memory of 1724 2992 cmd.exe 44 PID 2640 wrote to memory of 2840 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 45 PID 2640 wrote to memory of 2840 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 45 PID 2640 wrote to memory of 2840 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 45 PID 2640 wrote to memory of 2840 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 45 PID 2640 wrote to memory of 2940 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 46 PID 2640 wrote to memory of 2940 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 46 PID 2640 wrote to memory of 2940 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 46 PID 2640 wrote to memory of 2940 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 46 PID 2640 wrote to memory of 3040 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 48 PID 2640 wrote to memory of 3040 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 48 PID 2640 wrote to memory of 3040 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 48 PID 2640 wrote to memory of 3040 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 48 PID 2640 wrote to memory of 2060 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 50 PID 2640 wrote to memory of 2060 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 50 PID 2640 wrote to memory of 2060 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 50 PID 2640 wrote to memory of 2060 2640 2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe 50 PID 2060 wrote to memory of 1908 2060 cmd.exe 53 PID 2060 wrote to memory of 1908 2060 cmd.exe 53 PID 2060 wrote to memory of 1908 2060 cmd.exe 53 PID 2060 wrote to memory of 1908 2060 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\FmksoIAM\cmcMMYQI.exe"C:\Users\Admin\FmksoIAM\cmcMMYQI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2188
-
-
C:\ProgramData\LyMQcUUM\jokkYoUw.exe"C:\ProgramData\LyMQcUUM\jokkYoUw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2288
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"6⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"8⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2108 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"10⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"12⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:2984 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"14⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2548 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"16⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"18⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1444 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"20⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2420 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"22⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1816 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"24⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"26⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2444 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"28⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2548 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"30⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"32⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:308 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"34⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"36⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:2612 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"38⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2220 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"40⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2460 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"42⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:1312 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"44⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"46⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"48⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:2352 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"50⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2844 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"52⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:1036 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"54⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:2416 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"56⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1496 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"58⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"60⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2592 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"62⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"64⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock65⤵PID:3060
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"66⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock67⤵PID:876
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"68⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock69⤵PID:1624
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"70⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock71⤵PID:700
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"72⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock73⤵PID:1844
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"74⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock75⤵PID:3020
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"76⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock77⤵PID:908
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"78⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock79⤵PID:2596
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"80⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock81⤵PID:2412
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"82⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock83⤵PID:1512
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"84⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock85⤵PID:2536
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"86⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock87⤵PID:2652
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"88⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock89⤵PID:2860
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"90⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock91⤵PID:2544
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"92⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock93⤵PID:1948
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"94⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock95⤵PID:540
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"96⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock97⤵PID:928
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"98⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock99⤵PID:2864
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"100⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock101⤵PID:1752
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"102⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock103⤵PID:1256
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"104⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock105⤵PID:2148
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"106⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock107⤵PID:2964
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"108⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock109⤵PID:1976
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"110⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock111⤵PID:1868
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"112⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock113⤵PID:2436
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"114⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock115⤵PID:2596
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"116⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock117⤵PID:2560
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"118⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock119⤵PID:2344
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"120⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock121⤵PID:2884
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_1803e61f2f3642ff828ed67ef87f2ac3_virlock"122⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-