Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06-07-2024 18:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe
-
Size
121KB
-
MD5
4c7959b55961a3859db47073ccbbbfb6
-
SHA1
c54a1acc69b9df04a6c53c1d930bdd7408bf0018
-
SHA256
3d0c82dfdbc63d66fbcbfbd7c130637473b293d7ff30bcf2b3304f9c19113395
-
SHA512
1301826bdcea85fe4ca2a65a800d159a4842dca29633c659ce65f39e3363a5368160ff665253aba11bc8ac885030d797bc6c40b6f57a5d471cc91689f90d946a
-
SSDEEP
1536:E6pvgqzlgqLub80E8RQhANXdGyUtS5S9Ej46p4NgnkOE1YCeJ1nHaYBxrz+Rm0R8:E5JKKPNXB50PNgkg6YHrsm044EKRJa
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 61 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Control Panel\International\Geo\Nation aUMcoQIo.exe -
Deletes itself 1 IoCs
pid Process 2864 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1792 aUMcoQIo.exe 1972 CsQQQIsU.exe -
Loads dropped DLL 20 IoCs
pid Process 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\aUMcoQIo.exe = "C:\\Users\\Admin\\tIQssYkA\\aUMcoQIo.exe" aUMcoQIo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\goMcgEEI.exe = "C:\\Users\\Admin\\luowsAco\\goMcgEEI.exe" 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WqgAQMQY.exe = "C:\\ProgramData\\tssUwkow\\WqgAQMQY.exe" 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\aUMcoQIo.exe = "C:\\Users\\Admin\\tIQssYkA\\aUMcoQIo.exe" 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CsQQQIsU.exe = "C:\\ProgramData\\FwMAMIEI\\CsQQQIsU.exe" 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CsQQQIsU.exe = "C:\\ProgramData\\FwMAMIEI\\CsQQQIsU.exe" CsQQQIsU.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico aUMcoQIo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 772 1508 WerFault.exe 730 952 1592 WerFault.exe 731 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 1808 reg.exe 1856 reg.exe 2348 reg.exe 2456 reg.exe 1496 reg.exe 356 reg.exe 1240 reg.exe 2068 reg.exe 2072 reg.exe 2704 reg.exe 2852 reg.exe 548 reg.exe 1976 reg.exe 1920 reg.exe 2456 reg.exe 2712 reg.exe 1776 reg.exe 1276 reg.exe 1768 reg.exe 876 reg.exe 1636 reg.exe 2820 reg.exe 2580 reg.exe 2320 reg.exe 1588 reg.exe 2172 reg.exe 2596 reg.exe 1364 reg.exe 484 reg.exe 3004 reg.exe 2104 reg.exe 2356 reg.exe 2112 reg.exe 2348 reg.exe 2288 reg.exe 2712 reg.exe 2536 reg.exe 3060 reg.exe 1700 reg.exe 1664 reg.exe 2116 reg.exe 2616 reg.exe 2636 reg.exe 1856 reg.exe 1360 reg.exe 2912 reg.exe 3000 reg.exe 2872 reg.exe 1344 reg.exe 2380 reg.exe 1668 reg.exe 1588 reg.exe 2588 reg.exe 2932 reg.exe 2056 reg.exe 1588 reg.exe 1920 reg.exe 2584 reg.exe 2248 reg.exe 1948 reg.exe 2848 reg.exe 1384 reg.exe 1940 reg.exe 1680 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2672 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2672 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2864 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2864 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 448 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 448 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1096 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1096 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1048 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1048 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2892 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2892 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1376 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1376 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2348 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2348 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1728 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1728 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1744 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1744 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 964 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 964 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2836 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2836 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2700 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2700 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1316 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1316 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 544 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 544 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1620 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1620 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1372 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1372 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2744 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2744 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 3000 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 3000 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2520 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2520 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2756 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2756 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1992 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1992 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2776 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2776 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2352 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2352 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2804 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2804 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2024 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2024 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2060 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2060 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1628 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 1628 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2100 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 2100 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 776 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 776 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1792 aUMcoQIo.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe 1792 aUMcoQIo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 600 wrote to memory of 1792 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 30 PID 600 wrote to memory of 1792 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 30 PID 600 wrote to memory of 1792 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 30 PID 600 wrote to memory of 1792 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 30 PID 600 wrote to memory of 1972 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 31 PID 600 wrote to memory of 1972 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 31 PID 600 wrote to memory of 1972 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 31 PID 600 wrote to memory of 1972 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 31 PID 600 wrote to memory of 872 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 32 PID 600 wrote to memory of 872 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 32 PID 600 wrote to memory of 872 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 32 PID 600 wrote to memory of 872 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 32 PID 600 wrote to memory of 2116 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 34 PID 600 wrote to memory of 2116 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 34 PID 600 wrote to memory of 2116 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 34 PID 600 wrote to memory of 2116 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 34 PID 600 wrote to memory of 484 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 35 PID 600 wrote to memory of 484 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 35 PID 600 wrote to memory of 484 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 35 PID 600 wrote to memory of 484 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 35 PID 872 wrote to memory of 2724 872 cmd.exe 36 PID 872 wrote to memory of 2724 872 cmd.exe 36 PID 872 wrote to memory of 2724 872 cmd.exe 36 PID 872 wrote to memory of 2724 872 cmd.exe 36 PID 600 wrote to memory of 2812 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 37 PID 600 wrote to memory of 2812 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 37 PID 600 wrote to memory of 2812 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 37 PID 600 wrote to memory of 2812 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 37 PID 600 wrote to memory of 3036 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 38 PID 600 wrote to memory of 3036 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 38 PID 600 wrote to memory of 3036 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 38 PID 600 wrote to memory of 3036 600 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 38 PID 3036 wrote to memory of 2636 3036 cmd.exe 43 PID 3036 wrote to memory of 2636 3036 cmd.exe 43 PID 3036 wrote to memory of 2636 3036 cmd.exe 43 PID 3036 wrote to memory of 2636 3036 cmd.exe 43 PID 2724 wrote to memory of 2632 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 44 PID 2724 wrote to memory of 2632 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 44 PID 2724 wrote to memory of 2632 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 44 PID 2724 wrote to memory of 2632 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 44 PID 2632 wrote to memory of 2672 2632 cmd.exe 46 PID 2632 wrote to memory of 2672 2632 cmd.exe 46 PID 2632 wrote to memory of 2672 2632 cmd.exe 46 PID 2632 wrote to memory of 2672 2632 cmd.exe 46 PID 2724 wrote to memory of 1376 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 47 PID 2724 wrote to memory of 1376 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 47 PID 2724 wrote to memory of 1376 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 47 PID 2724 wrote to memory of 1376 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 47 PID 2724 wrote to memory of 2888 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 48 PID 2724 wrote to memory of 2888 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 48 PID 2724 wrote to memory of 2888 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 48 PID 2724 wrote to memory of 2888 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 48 PID 2724 wrote to memory of 2284 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 50 PID 2724 wrote to memory of 2284 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 50 PID 2724 wrote to memory of 2284 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 50 PID 2724 wrote to memory of 2284 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 50 PID 2724 wrote to memory of 2920 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 52 PID 2724 wrote to memory of 2920 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 52 PID 2724 wrote to memory of 2920 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 52 PID 2724 wrote to memory of 2920 2724 2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe 52 PID 2920 wrote to memory of 540 2920 cmd.exe 55 PID 2920 wrote to memory of 540 2920 cmd.exe 55 PID 2920 wrote to memory of 540 2920 cmd.exe 55 PID 2920 wrote to memory of 540 2920 cmd.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\tIQssYkA\aUMcoQIo.exe"C:\Users\Admin\tIQssYkA\aUMcoQIo.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1792
-
-
C:\ProgramData\FwMAMIEI\CsQQQIsU.exe"C:\ProgramData\FwMAMIEI\CsQQQIsU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1972
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2672 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"6⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2864 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"8⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:448 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"10⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1096 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"12⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1048 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"14⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"16⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1376 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"18⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2348 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"20⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"22⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1744 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"24⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:964 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"26⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2836 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"28⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"30⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"32⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:544 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"34⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"36⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"38⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2744 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"40⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"42⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:2520 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"44⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"46⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"48⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:2776 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"50⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2352 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"52⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2804 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"54⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:2024 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"56⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:2060 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"58⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:1628 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"60⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2100 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"62⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:776 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"64⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock65⤵PID:2068
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"66⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock67⤵PID:2952
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"68⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock69⤵PID:2032
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"70⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock71⤵PID:1812
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"72⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock73⤵PID:1108
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"74⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock75⤵PID:2876
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"76⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock77⤵PID:1376
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"78⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock79⤵PID:332
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"80⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock81⤵PID:2384
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"82⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock83⤵PID:1752
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"84⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock85⤵PID:2416
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"86⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock87⤵PID:2256
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"88⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock89⤵PID:2424
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"90⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock91⤵PID:3068
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"92⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock93⤵PID:548
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"94⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock95⤵PID:2336
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"96⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock97⤵PID:2736
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"98⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock99⤵PID:2380
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"100⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock101⤵PID:916
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"102⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock103⤵PID:2692
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"104⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock105⤵PID:3016
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"106⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock107⤵PID:2184
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"108⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock109⤵PID:2056
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"110⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock111⤵PID:448
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"112⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock113⤵PID:1756
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"114⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock115⤵PID:2024
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"116⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock117⤵
- Adds Run key to start application
PID:992 -
C:\Users\Admin\luowsAco\goMcgEEI.exe"C:\Users\Admin\luowsAco\goMcgEEI.exe"118⤵PID:1508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 36119⤵
- Program crash
PID:772
-
-
-
C:\ProgramData\tssUwkow\WqgAQMQY.exe"C:\ProgramData\tssUwkow\WqgAQMQY.exe"118⤵PID:1592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 36119⤵
- Program crash
PID:952
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"118⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock119⤵PID:2336
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock"120⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-07-06_4c7959b55961a3859db47073ccbbbfb6_virlock121⤵PID:2744
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1122⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-