Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 03:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe
-
Size
198KB
-
MD5
b8c317c5dac2e17763d02f26035d11a6
-
SHA1
3a9d78353ba8890cae4bb2d6d2cc5ea5ee3772fd
-
SHA256
5e5d97b3ad7174aa09f7ef9785036173179dfdb0d187eb96476614fc11d143a7
-
SHA512
e14ce8c3cfb0c9cd763d12bdd02acbf41595dd6adf01837a38f29652bf5ac609e359c1bf79fef55e8bf54d1026f287c0d45b98fd97bdb0f6eefdaff2a93c5a9c
-
SSDEEP
6144:1PorCbp0zrFbiuqpFQpsgbZXphEjxchyS/P8+eb0Majj2a6Ew:1PazrFbiuqpFQpsgbZXphEjxchygzebq
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (86) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation KmIwckIE.exe -
Executes dropped EXE 2 IoCs
pid Process 3244 KmIwckIE.exe 5056 EWcQUgcg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EWcQUgcg.exe = "C:\\ProgramData\\hIUgUEkg\\EWcQUgcg.exe" EWcQUgcg.exe Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KmIwckIE.exe = "C:\\Users\\Admin\\kwEYkAoE\\KmIwckIE.exe" 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EWcQUgcg.exe = "C:\\ProgramData\\hIUgUEkg\\EWcQUgcg.exe" 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KmIwckIE.exe = "C:\\Users\\Admin\\kwEYkAoE\\KmIwckIE.exe" KmIwckIE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 5100 reg.exe 2496 reg.exe 3616 reg.exe 3724 reg.exe 1444 reg.exe 4808 reg.exe 4212 reg.exe 1788 reg.exe 1252 reg.exe 2540 Process not Found 1372 reg.exe 3552 reg.exe 4304 reg.exe 5116 reg.exe 4088 reg.exe 1064 reg.exe 3172 reg.exe 4032 reg.exe 4664 reg.exe 2388 reg.exe 3188 reg.exe 512 reg.exe 3804 reg.exe 3956 reg.exe 2448 Process not Found 5080 reg.exe 4480 reg.exe 2000 Process not Found 4076 reg.exe 4048 reg.exe 4196 reg.exe 3988 reg.exe 3616 reg.exe 3680 reg.exe 2180 reg.exe 760 reg.exe 3124 reg.exe 4288 reg.exe 5108 reg.exe 3512 reg.exe 1436 Process not Found 4100 reg.exe 2888 reg.exe 2660 reg.exe 3536 Process not Found 1220 Process not Found 2332 Process not Found 5028 reg.exe 4672 reg.exe 2012 reg.exe 3568 Process not Found 4192 reg.exe 2260 reg.exe 2916 Process not Found 4396 reg.exe 1412 reg.exe 4020 reg.exe 3772 reg.exe 3788 reg.exe 1384 reg.exe 2100 reg.exe 3416 reg.exe 3820 reg.exe 460 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1240 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1240 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1240 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1240 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4760 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4760 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4760 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4760 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 116 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 116 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 116 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 116 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 8 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 8 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 8 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 8 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4952 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4952 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4952 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4952 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4840 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4840 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4840 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4840 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 2088 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 2088 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 2088 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 2088 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 3188 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 3188 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 3188 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 3188 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1584 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1584 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1584 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1584 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1396 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1396 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1396 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 1396 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4880 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4880 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4880 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4880 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4016 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4016 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4016 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 4016 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 5028 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 5028 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 5028 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 5028 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3244 KmIwckIE.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe 3244 KmIwckIE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 3244 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 84 PID 3576 wrote to memory of 3244 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 84 PID 3576 wrote to memory of 3244 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 84 PID 3576 wrote to memory of 5056 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 85 PID 3576 wrote to memory of 5056 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 85 PID 3576 wrote to memory of 5056 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 85 PID 3576 wrote to memory of 912 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 86 PID 3576 wrote to memory of 912 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 86 PID 3576 wrote to memory of 912 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 86 PID 912 wrote to memory of 2416 912 cmd.exe 88 PID 912 wrote to memory of 2416 912 cmd.exe 88 PID 912 wrote to memory of 2416 912 cmd.exe 88 PID 3576 wrote to memory of 3012 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 90 PID 3576 wrote to memory of 3012 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 90 PID 3576 wrote to memory of 3012 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 90 PID 3576 wrote to memory of 3972 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 91 PID 3576 wrote to memory of 3972 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 91 PID 3576 wrote to memory of 3972 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 91 PID 3576 wrote to memory of 1912 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 92 PID 3576 wrote to memory of 1912 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 92 PID 3576 wrote to memory of 1912 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 92 PID 3576 wrote to memory of 2216 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 93 PID 3576 wrote to memory of 2216 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 93 PID 3576 wrote to memory of 2216 3576 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 93 PID 2216 wrote to memory of 1088 2216 cmd.exe 98 PID 2216 wrote to memory of 1088 2216 cmd.exe 98 PID 2216 wrote to memory of 1088 2216 cmd.exe 98 PID 2416 wrote to memory of 1144 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 99 PID 2416 wrote to memory of 1144 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 99 PID 2416 wrote to memory of 1144 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 99 PID 1144 wrote to memory of 4896 1144 cmd.exe 101 PID 1144 wrote to memory of 4896 1144 cmd.exe 101 PID 1144 wrote to memory of 4896 1144 cmd.exe 101 PID 2416 wrote to memory of 2000 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 102 PID 2416 wrote to memory of 2000 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 102 PID 2416 wrote to memory of 2000 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 102 PID 2416 wrote to memory of 3772 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 103 PID 2416 wrote to memory of 3772 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 103 PID 2416 wrote to memory of 3772 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 103 PID 2416 wrote to memory of 3720 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 104 PID 2416 wrote to memory of 3720 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 104 PID 2416 wrote to memory of 3720 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 104 PID 2416 wrote to memory of 2356 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 105 PID 2416 wrote to memory of 2356 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 105 PID 2416 wrote to memory of 2356 2416 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 105 PID 2356 wrote to memory of 2568 2356 cmd.exe 110 PID 2356 wrote to memory of 2568 2356 cmd.exe 110 PID 2356 wrote to memory of 2568 2356 cmd.exe 110 PID 4896 wrote to memory of 4312 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 111 PID 4896 wrote to memory of 4312 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 111 PID 4896 wrote to memory of 4312 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 111 PID 4312 wrote to memory of 1240 4312 cmd.exe 113 PID 4312 wrote to memory of 1240 4312 cmd.exe 113 PID 4312 wrote to memory of 1240 4312 cmd.exe 113 PID 4896 wrote to memory of 4100 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 114 PID 4896 wrote to memory of 4100 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 114 PID 4896 wrote to memory of 4100 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 114 PID 4896 wrote to memory of 692 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 115 PID 4896 wrote to memory of 692 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 115 PID 4896 wrote to memory of 692 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 115 PID 4896 wrote to memory of 1252 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 116 PID 4896 wrote to memory of 1252 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 116 PID 4896 wrote to memory of 1252 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 116 PID 4896 wrote to memory of 3788 4896 2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\kwEYkAoE\KmIwckIE.exe"C:\Users\Admin\kwEYkAoE\KmIwckIE.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3244
-
-
C:\ProgramData\hIUgUEkg\EWcQUgcg.exe"C:\ProgramData\hIUgUEkg\EWcQUgcg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"8⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"10⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"12⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"14⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"16⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"18⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"20⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"22⤵PID:2284
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵PID:3048
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"24⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"26⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"28⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"30⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"32⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock33⤵PID:1076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"34⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock35⤵PID:1144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"36⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock37⤵PID:3684
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"38⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock39⤵PID:3576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"40⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock41⤵PID:3324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"42⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock43⤵PID:2448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"44⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock45⤵PID:4272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"46⤵PID:4432
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock47⤵PID:1112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"48⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock49⤵PID:4640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"50⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock51⤵PID:548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"52⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock53⤵PID:2416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"54⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock55⤵PID:4416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"56⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock57⤵PID:3724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"58⤵PID:1484
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵PID:3064
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock59⤵PID:2748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"60⤵PID:1828
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵PID:4952
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock61⤵PID:3644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"62⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock63⤵PID:2260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"64⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock65⤵PID:1536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"66⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock67⤵PID:1864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"68⤵PID:2044
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵PID:2284
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock69⤵PID:2684
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"70⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock71⤵PID:1320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"72⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock73⤵PID:2928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"74⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock75⤵PID:3588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"76⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock77⤵PID:3644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"78⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock79⤵PID:4176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"80⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock81⤵PID:5040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"82⤵PID:3616
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:4220
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock83⤵PID:3592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"84⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock85⤵PID:2628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"86⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock87⤵PID:2296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"88⤵PID:2164
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:3788
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock89⤵PID:2928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"90⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock91⤵PID:2004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"92⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock93⤵PID:1992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"94⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock95⤵PID:3804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"96⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock97⤵PID:4192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"98⤵PID:3216
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:460
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock99⤵PID:4332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"100⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock101⤵PID:3952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"102⤵PID:1248
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵PID:4460
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock103⤵PID:1584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"104⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock105⤵PID:2324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"106⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock107⤵PID:3132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"108⤵PID:5048
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock109⤵PID:400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"110⤵PID:4176
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:2164
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock111⤵PID:4516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"112⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock113⤵PID:548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"114⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock115⤵PID:4868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"116⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock117⤵PID:1484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"118⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock119⤵PID:1256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"120⤵PID:2260
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵PID:5108
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock121⤵PID:4456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-08_b8c317c5dac2e17763d02f26035d11a6_virlock"122⤵PID:2628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-