Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 20:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe
-
Size
138KB
-
MD5
655c4e0d2a32c9c40f806582f15656d0
-
SHA1
55424c2985c89cdb88ea6f09f414c87469fe79f7
-
SHA256
f09a47c590aa6ac6b40d660400b9862fd3f07f1c89c8c5d8273d3acb58f884e2
-
SHA512
9ec1c398d47e950edaaf2866d771f5c02462717da42cb4429af1ca7f293d1ab7515c0bcd1e931d9e783a4764f03f7d60628269a4ac957779a5095ac7f6d220e2
-
SSDEEP
3072:LUSHc06BxtaO/SdRwG1LbTb9iUyE3AzG8LrBrC+0UuSaydVq:LRP6kOqRwiRiwA6OrcNoay
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Control Panel\International\Geo\Nation roEIQYIY.exe -
Deletes itself 1 IoCs
pid Process 2732 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 3012 OKMQoEAI.exe 2128 roEIQYIY.exe -
Loads dropped DLL 20 IoCs
pid Process 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\OKMQoEAI.exe = "C:\\Users\\Admin\\VoMUsAUo\\OKMQoEAI.exe" OKMQoEAI.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\OKMQoEAI.exe = "C:\\Users\\Admin\\VoMUsAUo\\OKMQoEAI.exe" 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\roEIQYIY.exe = "C:\\ProgramData\\ieMQgwQw\\roEIQYIY.exe" 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\roEIQYIY.exe = "C:\\ProgramData\\ieMQgwQw\\roEIQYIY.exe" roEIQYIY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 2412 reg.exe 1608 reg.exe 1708 reg.exe 2536 reg.exe 824 reg.exe 112 reg.exe 1616 reg.exe 2264 reg.exe 1196 reg.exe 1280 reg.exe 1208 reg.exe 1364 reg.exe 748 reg.exe 1648 reg.exe 940 reg.exe 556 reg.exe 1944 reg.exe 384 reg.exe 1656 reg.exe 2756 reg.exe 2728 reg.exe 2644 reg.exe 2000 reg.exe 1964 reg.exe 1220 reg.exe 2428 reg.exe 2872 reg.exe 752 reg.exe 1228 reg.exe 1296 reg.exe 1360 reg.exe 2320 reg.exe 320 reg.exe 1632 reg.exe 2416 reg.exe 2604 reg.exe 2552 reg.exe 2256 reg.exe 2980 reg.exe 2372 reg.exe 1792 reg.exe 2696 reg.exe 836 reg.exe 2016 reg.exe 2600 reg.exe 1956 reg.exe 2928 reg.exe 2496 reg.exe 2336 reg.exe 2656 reg.exe 1868 reg.exe 2740 reg.exe 696 reg.exe 2884 reg.exe 2676 reg.exe 1284 reg.exe 284 reg.exe 2260 reg.exe 1344 reg.exe 2708 reg.exe 1984 reg.exe 2924 reg.exe 688 reg.exe 1580 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2608 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2608 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2172 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2172 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2812 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2812 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1924 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1924 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1476 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1476 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2992 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2992 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2700 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2700 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1048 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1048 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2112 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2112 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1620 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1620 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 940 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 940 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2640 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2640 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2564 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2564 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2752 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2752 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1580 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1580 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 676 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 676 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1616 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1616 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2652 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2652 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2460 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2460 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1012 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1012 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2284 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2284 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1808 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1808 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2084 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2084 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1168 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1168 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2732 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2732 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2796 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2796 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1744 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1744 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2700 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2700 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1692 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 1692 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2804 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 2804 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2128 roEIQYIY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe 2128 roEIQYIY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 3012 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 28 PID 2200 wrote to memory of 3012 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 28 PID 2200 wrote to memory of 3012 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 28 PID 2200 wrote to memory of 3012 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 28 PID 2200 wrote to memory of 2128 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 29 PID 2200 wrote to memory of 2128 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 29 PID 2200 wrote to memory of 2128 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 29 PID 2200 wrote to memory of 2128 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 29 PID 2200 wrote to memory of 2796 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 30 PID 2200 wrote to memory of 2796 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 30 PID 2200 wrote to memory of 2796 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 30 PID 2200 wrote to memory of 2796 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 30 PID 2796 wrote to memory of 2568 2796 cmd.exe 33 PID 2796 wrote to memory of 2568 2796 cmd.exe 33 PID 2796 wrote to memory of 2568 2796 cmd.exe 33 PID 2796 wrote to memory of 2568 2796 cmd.exe 33 PID 2200 wrote to memory of 2412 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 32 PID 2200 wrote to memory of 2412 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 32 PID 2200 wrote to memory of 2412 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 32 PID 2200 wrote to memory of 2412 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 32 PID 2200 wrote to memory of 2576 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 34 PID 2200 wrote to memory of 2576 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 34 PID 2200 wrote to memory of 2576 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 34 PID 2200 wrote to memory of 2576 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 34 PID 2200 wrote to memory of 2716 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 35 PID 2200 wrote to memory of 2716 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 35 PID 2200 wrote to memory of 2716 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 35 PID 2200 wrote to memory of 2716 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 35 PID 2200 wrote to memory of 2436 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 36 PID 2200 wrote to memory of 2436 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 36 PID 2200 wrote to memory of 2436 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 36 PID 2200 wrote to memory of 2436 2200 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 36 PID 2568 wrote to memory of 1744 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 40 PID 2568 wrote to memory of 1744 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 40 PID 2568 wrote to memory of 1744 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 40 PID 2568 wrote to memory of 1744 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 40 PID 1744 wrote to memory of 2608 1744 cmd.exe 43 PID 1744 wrote to memory of 2608 1744 cmd.exe 43 PID 1744 wrote to memory of 2608 1744 cmd.exe 43 PID 1744 wrote to memory of 2608 1744 cmd.exe 43 PID 2568 wrote to memory of 1492 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 45 PID 2568 wrote to memory of 1492 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 45 PID 2568 wrote to memory of 1492 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 45 PID 2568 wrote to memory of 1492 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 45 PID 2568 wrote to memory of 868 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 46 PID 2568 wrote to memory of 868 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 46 PID 2568 wrote to memory of 868 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 46 PID 2568 wrote to memory of 868 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 46 PID 2568 wrote to memory of 2604 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 47 PID 2568 wrote to memory of 2604 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 47 PID 2568 wrote to memory of 2604 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 47 PID 2568 wrote to memory of 2604 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 47 PID 2568 wrote to memory of 2704 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 48 PID 2568 wrote to memory of 2704 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 48 PID 2568 wrote to memory of 2704 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 48 PID 2568 wrote to memory of 2704 2568 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 48 PID 2436 wrote to memory of 1496 2436 cmd.exe 44 PID 2436 wrote to memory of 1496 2436 cmd.exe 44 PID 2436 wrote to memory of 1496 2436 cmd.exe 44 PID 2436 wrote to memory of 1496 2436 cmd.exe 44 PID 2608 wrote to memory of 2380 2608 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 53 PID 2608 wrote to memory of 2380 2608 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 53 PID 2608 wrote to memory of 2380 2608 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 53 PID 2608 wrote to memory of 2380 2608 2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\VoMUsAUo\OKMQoEAI.exe"C:\Users\Admin\VoMUsAUo\OKMQoEAI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3012
-
-
C:\ProgramData\ieMQgwQw\roEIQYIY.exe"C:\ProgramData\ieMQgwQw\roEIQYIY.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2128
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"6⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2172 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"8⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"10⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"12⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1476 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"14⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"16⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"18⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1048 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"20⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"22⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"24⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:940 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"26⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2640 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"28⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2564 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"30⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"32⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"34⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:676 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"36⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"38⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2652 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"40⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2460 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"42⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:1012 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"44⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2284 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"46⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:1808 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"48⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:2084 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"50⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:1168 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"52⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"54⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"56⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1744 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"58⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"60⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"62⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2804 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"64⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock65⤵PID:664
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"66⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock67⤵PID:1944
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"68⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock69⤵PID:2116
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"70⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock71⤵PID:576
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"72⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock73⤵PID:2276
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"74⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock75⤵PID:2292
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"76⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock77⤵PID:2468
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"78⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock79⤵PID:2576
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"80⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock81⤵PID:1924
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"82⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock83⤵PID:2544
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"84⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock85⤵PID:2040
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"86⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock87⤵PID:2712
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"88⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock89⤵PID:3008
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"90⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock91⤵PID:2552
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"92⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock93⤵PID:620
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"94⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock95⤵PID:2428
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"96⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock97⤵PID:2236
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"98⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock99⤵PID:1012
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"100⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock101⤵PID:2980
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"102⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock103⤵PID:2000
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"104⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock105⤵PID:1284
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"106⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock107⤵PID:688
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"108⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock109⤵PID:1860
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"110⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock111⤵PID:2028
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"112⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock113⤵PID:796
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"114⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock115⤵PID:2296
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"116⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock117⤵PID:928
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"118⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock119⤵PID:2172
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"120⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock121⤵PID:2084
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-04-05_655c4e0d2a32c9c40f806582f15656d0_virlock"122⤵PID:1132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-