Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 03:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe
-
Size
190KB
-
MD5
213e54e8e0cfc370f9c7839facb48323
-
SHA1
a4eb90787752567f1f9b63e8df6ffecc758a59f9
-
SHA256
69aeaec4d5c9e024ff15234ae8bc5aaf97b98f410e364fc5109a7c1c36f0a168
-
SHA512
85795f86660741063465ba2b94f212dae3a97962df07ef995e9f62ce555cd32a7bef8d5c4702db12f608cf0b8c70608b6db582fc8826dfd5f071dcb7419a0fc8
-
SSDEEP
3072:eozsn4c3TJZKPMmymb6fZKnzH5zhRstsx8PhAJbPBgyjgpKa+P5cIBrVZazvn6R:nY4c3TmPM5mtvRosePgbPBTuJ+P5JJ/n
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (58) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\International\Geo\Nation ImkowQAc.exe -
Executes dropped EXE 2 IoCs
pid Process 2980 ImkowQAc.exe 2604 iIQcMoMY.exe -
Loads dropped DLL 20 IoCs
pid Process 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ImkowQAc.exe = "C:\\Users\\Admin\\JsMYYEgA\\ImkowQAc.exe" 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iIQcMoMY.exe = "C:\\ProgramData\\QSgEockU\\iIQcMoMY.exe" 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ImkowQAc.exe = "C:\\Users\\Admin\\JsMYYEgA\\ImkowQAc.exe" ImkowQAc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iIQcMoMY.exe = "C:\\ProgramData\\QSgEockU\\iIQcMoMY.exe" iIQcMoMY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 2792 reg.exe 2752 reg.exe 880 reg.exe 2988 reg.exe 1580 reg.exe 1216 reg.exe 2384 reg.exe 1652 reg.exe 1064 reg.exe 2416 reg.exe 2648 reg.exe 2728 reg.exe 2864 reg.exe 752 reg.exe 2064 reg.exe 1916 reg.exe 1476 reg.exe 1652 reg.exe 2880 reg.exe 2436 reg.exe 2328 reg.exe 2596 reg.exe 1020 reg.exe 2644 reg.exe 2132 reg.exe 1224 reg.exe 1616 reg.exe 1624 reg.exe 2592 reg.exe 2744 reg.exe 2388 reg.exe 1944 reg.exe 1272 reg.exe 3032 reg.exe 2052 reg.exe 2740 reg.exe 1404 reg.exe 2796 reg.exe 1988 reg.exe 1672 reg.exe 2996 reg.exe 1776 reg.exe 2904 reg.exe 2172 reg.exe 1648 reg.exe 2712 reg.exe 2740 reg.exe 2464 reg.exe 580 reg.exe 1904 reg.exe 2464 reg.exe 768 reg.exe 1764 reg.exe 2124 reg.exe 1536 reg.exe 1620 reg.exe 628 reg.exe 1420 reg.exe 2124 reg.exe 2672 reg.exe 2256 reg.exe 1936 reg.exe 2688 reg.exe 1664 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2696 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2696 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1452 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1452 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2892 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2892 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1704 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1704 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1940 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1940 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1632 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1632 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1176 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1176 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1340 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1340 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2240 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2240 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2552 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2552 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2460 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2460 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2716 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2716 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2008 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2008 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1908 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1908 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1624 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1624 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2240 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2240 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2312 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2312 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1532 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1532 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1632 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1632 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2984 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2984 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1388 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1388 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2680 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2680 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2524 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2524 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2700 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2700 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 856 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 856 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2024 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2024 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2444 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2444 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2884 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 2884 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1020 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 1020 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2980 ImkowQAc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe 2980 ImkowQAc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1608 wrote to memory of 2980 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 28 PID 1608 wrote to memory of 2980 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 28 PID 1608 wrote to memory of 2980 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 28 PID 1608 wrote to memory of 2980 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 28 PID 1608 wrote to memory of 2604 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 29 PID 1608 wrote to memory of 2604 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 29 PID 1608 wrote to memory of 2604 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 29 PID 1608 wrote to memory of 2604 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 29 PID 1608 wrote to memory of 2600 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 30 PID 1608 wrote to memory of 2600 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 30 PID 1608 wrote to memory of 2600 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 30 PID 1608 wrote to memory of 2600 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 30 PID 2600 wrote to memory of 2864 2600 cmd.exe 32 PID 2600 wrote to memory of 2864 2600 cmd.exe 32 PID 2600 wrote to memory of 2864 2600 cmd.exe 32 PID 2600 wrote to memory of 2864 2600 cmd.exe 32 PID 1608 wrote to memory of 1192 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 33 PID 1608 wrote to memory of 1192 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 33 PID 1608 wrote to memory of 1192 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 33 PID 1608 wrote to memory of 1192 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 33 PID 1608 wrote to memory of 2740 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 34 PID 1608 wrote to memory of 2740 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 34 PID 1608 wrote to memory of 2740 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 34 PID 1608 wrote to memory of 2740 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 34 PID 1608 wrote to memory of 2052 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 35 PID 1608 wrote to memory of 2052 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 35 PID 1608 wrote to memory of 2052 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 35 PID 1608 wrote to memory of 2052 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 35 PID 1608 wrote to memory of 2684 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 36 PID 1608 wrote to memory of 2684 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 36 PID 1608 wrote to memory of 2684 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 36 PID 1608 wrote to memory of 2684 1608 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 36 PID 2684 wrote to memory of 2312 2684 cmd.exe 41 PID 2684 wrote to memory of 2312 2684 cmd.exe 41 PID 2684 wrote to memory of 2312 2684 cmd.exe 41 PID 2684 wrote to memory of 2312 2684 cmd.exe 41 PID 2864 wrote to memory of 856 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 42 PID 2864 wrote to memory of 856 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 42 PID 2864 wrote to memory of 856 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 42 PID 2864 wrote to memory of 856 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 42 PID 856 wrote to memory of 2696 856 cmd.exe 44 PID 856 wrote to memory of 2696 856 cmd.exe 44 PID 856 wrote to memory of 2696 856 cmd.exe 44 PID 856 wrote to memory of 2696 856 cmd.exe 44 PID 2864 wrote to memory of 2788 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 45 PID 2864 wrote to memory of 2788 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 45 PID 2864 wrote to memory of 2788 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 45 PID 2864 wrote to memory of 2788 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 45 PID 2864 wrote to memory of 1580 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 46 PID 2864 wrote to memory of 1580 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 46 PID 2864 wrote to memory of 1580 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 46 PID 2864 wrote to memory of 1580 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 46 PID 2864 wrote to memory of 2796 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 47 PID 2864 wrote to memory of 2796 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 47 PID 2864 wrote to memory of 2796 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 47 PID 2864 wrote to memory of 2796 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 47 PID 2864 wrote to memory of 1552 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 48 PID 2864 wrote to memory of 1552 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 48 PID 2864 wrote to memory of 1552 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 48 PID 2864 wrote to memory of 1552 2864 2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe 48 PID 1552 wrote to memory of 2180 1552 cmd.exe 53 PID 1552 wrote to memory of 2180 1552 cmd.exe 53 PID 1552 wrote to memory of 2180 1552 cmd.exe 53 PID 1552 wrote to memory of 2180 1552 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\JsMYYEgA\ImkowQAc.exe"C:\Users\Admin\JsMYYEgA\ImkowQAc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2980
-
-
C:\ProgramData\QSgEockU\iIQcMoMY.exe"C:\ProgramData\QSgEockU\iIQcMoMY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2604
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2696 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"6⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1452 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"8⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"10⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1704 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"12⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"14⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"16⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2864 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"18⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1176 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"20⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"22⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2240 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"24⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2552 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"26⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2460 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"28⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2716 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"30⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"32⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1908 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"34⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"36⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:2240 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"38⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"40⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:1532 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"42⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"44⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2984 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"46⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"48⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:2680 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"50⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2524 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"52⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"54⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:856 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"56⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:2024 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"58⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:2444 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"60⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2884 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"62⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:1020 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"64⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock65⤵PID:1476
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"66⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock67⤵PID:744
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"68⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock69⤵PID:2168
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"70⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock71⤵PID:1908
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"72⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock73⤵PID:2568
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"74⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock75⤵PID:1416
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"76⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock77⤵PID:2692
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"78⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock79⤵PID:2552
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"80⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock81⤵PID:748
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"82⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock83⤵PID:408
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"84⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock85⤵PID:884
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"86⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock87⤵PID:2668
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"88⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock89⤵PID:2652
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"90⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock91⤵PID:872
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"92⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock93⤵PID:1396
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"94⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock95⤵PID:2148
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"96⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock97⤵PID:2300
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"98⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock99⤵PID:2564
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"100⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock101⤵PID:1492
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"102⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock103⤵PID:2840
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"104⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock105⤵PID:2740
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"106⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock107⤵PID:2440
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"108⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock109⤵PID:340
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"110⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock111⤵PID:2312
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"112⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock113⤵PID:768
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"114⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock115⤵PID:1892
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"116⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock117⤵PID:2580
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"118⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock119⤵PID:1616
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"120⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock121⤵PID:2084
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-26_213e54e8e0cfc370f9c7839facb48323_virlock"122⤵PID:1872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-