Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 11:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe
-
Size
207KB
-
MD5
8227145fd2cb70f9e2b1284a1e764b40
-
SHA1
6a97aab07daa122dbae0469b64cdc027a1d94c7b
-
SHA256
83a0f7343dbc04cdafab4ba4cbe7b3d1a38ea2cf6a63db04f3f5d23fd8ad2226
-
SHA512
9abdbcae616d1661f603ef52590033c2634a5b47297ca9d22bab9cd989a4d1ddc1c9b97c016bcaedc59527b01b96a02de618ea107324f32d9878a5d9e45a17f5
-
SSDEEP
6144:lWHsWT9gLQWr0ldD2bb4HT1t60fWf0QlIgK8/nnEv:lK9TEQWrcdD2bb4HT1FfWf0QlIhcnEv
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found -
Renames multiple (70) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation qgEkkUEc.exe -
Executes dropped EXE 2 IoCs
pid Process 4884 qgEkkUEc.exe 2804 yQEQAYcY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qgEkkUEc.exe = "C:\\Users\\Admin\\ZiAIAMoA\\qgEkkUEc.exe" 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yQEQAYcY.exe = "C:\\ProgramData\\wiIgAwEU\\yQEQAYcY.exe" 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qgEkkUEc.exe = "C:\\Users\\Admin\\ZiAIAMoA\\qgEkkUEc.exe" qgEkkUEc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yQEQAYcY.exe = "C:\\ProgramData\\wiIgAwEU\\yQEQAYcY.exe" yQEQAYcY.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe qgEkkUEc.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe qgEkkUEc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 2888 reg.exe 792 reg.exe 5032 reg.exe 536 reg.exe 1204 reg.exe 2580 reg.exe 3600 reg.exe 1248 reg.exe 5048 reg.exe 5112 reg.exe 2676 reg.exe 3528 reg.exe 1452 reg.exe 4656 Process not Found 424 reg.exe 2476 reg.exe 2068 reg.exe 5104 reg.exe 4016 reg.exe 1488 reg.exe 4488 reg.exe 1460 Process not Found 2880 Process not Found 2156 reg.exe 3956 reg.exe 3400 reg.exe 3328 reg.exe 1448 reg.exe 4276 Process not Found 2448 reg.exe 1840 reg.exe 3864 reg.exe 2564 reg.exe 4036 reg.exe 916 reg.exe 2912 reg.exe 4584 reg.exe 3452 reg.exe 60 reg.exe 4908 reg.exe 3428 reg.exe 4460 reg.exe 3408 reg.exe 4460 reg.exe 1968 reg.exe 4952 reg.exe 4980 reg.exe 1424 reg.exe 1860 reg.exe 432 reg.exe 5104 reg.exe 2368 reg.exe 2060 reg.exe 1684 reg.exe 992 reg.exe 2408 reg.exe 788 reg.exe 4968 reg.exe 2772 reg.exe 1032 reg.exe 3248 Process not Found 3700 reg.exe 4880 reg.exe 3188 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4328 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4328 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4328 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4328 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4508 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4508 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4508 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4508 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 880 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 880 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 880 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 880 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4036 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4036 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4036 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4036 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 712 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 712 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 712 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 712 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4292 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4292 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4292 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4292 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 1380 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 1380 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 1380 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 1380 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4348 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4348 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4348 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4348 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 2408 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 2408 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 2408 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 2408 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 3136 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 3136 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 3136 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 3136 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4660 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4660 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4660 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 4660 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 2776 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 2776 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 2776 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 2776 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 1280 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 1280 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 1280 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 1280 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4884 qgEkkUEc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe 4884 qgEkkUEc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4884 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 84 PID 4980 wrote to memory of 4884 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 84 PID 4980 wrote to memory of 4884 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 84 PID 4980 wrote to memory of 2804 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 85 PID 4980 wrote to memory of 2804 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 85 PID 4980 wrote to memory of 2804 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 85 PID 4980 wrote to memory of 4908 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 86 PID 4980 wrote to memory of 4908 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 86 PID 4980 wrote to memory of 4908 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 86 PID 4908 wrote to memory of 3672 4908 cmd.exe 88 PID 4908 wrote to memory of 3672 4908 cmd.exe 88 PID 4908 wrote to memory of 3672 4908 cmd.exe 88 PID 4980 wrote to memory of 1188 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 89 PID 4980 wrote to memory of 1188 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 89 PID 4980 wrote to memory of 1188 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 89 PID 4980 wrote to memory of 788 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 90 PID 4980 wrote to memory of 788 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 90 PID 4980 wrote to memory of 788 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 90 PID 4980 wrote to memory of 2580 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 91 PID 4980 wrote to memory of 2580 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 91 PID 4980 wrote to memory of 2580 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 91 PID 4980 wrote to memory of 3528 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 92 PID 4980 wrote to memory of 3528 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 92 PID 4980 wrote to memory of 3528 4980 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 92 PID 3528 wrote to memory of 4064 3528 cmd.exe 97 PID 3528 wrote to memory of 4064 3528 cmd.exe 97 PID 3528 wrote to memory of 4064 3528 cmd.exe 97 PID 3672 wrote to memory of 2512 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 98 PID 3672 wrote to memory of 2512 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 98 PID 3672 wrote to memory of 2512 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 98 PID 2512 wrote to memory of 396 2512 cmd.exe 100 PID 2512 wrote to memory of 396 2512 cmd.exe 100 PID 2512 wrote to memory of 396 2512 cmd.exe 100 PID 3672 wrote to memory of 1424 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 101 PID 3672 wrote to memory of 1424 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 101 PID 3672 wrote to memory of 1424 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 101 PID 3672 wrote to memory of 2888 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 102 PID 3672 wrote to memory of 2888 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 102 PID 3672 wrote to memory of 2888 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 102 PID 3672 wrote to memory of 3600 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 104 PID 3672 wrote to memory of 3600 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 104 PID 3672 wrote to memory of 3600 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 104 PID 3672 wrote to memory of 4520 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 105 PID 3672 wrote to memory of 4520 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 105 PID 3672 wrote to memory of 4520 3672 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 105 PID 4520 wrote to memory of 920 4520 cmd.exe 109 PID 4520 wrote to memory of 920 4520 cmd.exe 109 PID 4520 wrote to memory of 920 4520 cmd.exe 109 PID 396 wrote to memory of 1560 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 110 PID 396 wrote to memory of 1560 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 110 PID 396 wrote to memory of 1560 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 110 PID 1560 wrote to memory of 4328 1560 cmd.exe 112 PID 1560 wrote to memory of 4328 1560 cmd.exe 112 PID 1560 wrote to memory of 4328 1560 cmd.exe 112 PID 396 wrote to memory of 4252 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 113 PID 396 wrote to memory of 4252 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 113 PID 396 wrote to memory of 4252 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 113 PID 396 wrote to memory of 4292 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 114 PID 396 wrote to memory of 4292 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 114 PID 396 wrote to memory of 4292 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 114 PID 396 wrote to memory of 5100 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 115 PID 396 wrote to memory of 5100 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 115 PID 396 wrote to memory of 5100 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 115 PID 396 wrote to memory of 2448 396 2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\ZiAIAMoA\qgEkkUEc.exe"C:\Users\Admin\ZiAIAMoA\qgEkkUEc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4884
-
-
C:\ProgramData\wiIgAwEU\yQEQAYcY.exe"C:\ProgramData\wiIgAwEU\yQEQAYcY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2804
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"8⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"10⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"12⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"14⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"16⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"18⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"20⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"22⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"24⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"26⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"28⤵PID:1348
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵PID:3276
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"30⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"32⤵PID:3116
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵PID:2156
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock33⤵PID:3272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"34⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock35⤵PID:4656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"36⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock37⤵PID:4428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"38⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock39⤵PID:4000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"40⤵PID:4792
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵PID:2912
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock41⤵PID:1668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"42⤵PID:2408
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵PID:4352
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock43⤵PID:1056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"44⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock45⤵PID:2228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"46⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock47⤵PID:3456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"48⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock49⤵PID:4808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"50⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock51⤵PID:3328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"52⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock53⤵PID:740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"54⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock55⤵PID:3564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"56⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock57⤵PID:4292
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"58⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock59⤵PID:3396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"60⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock61⤵PID:4004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"62⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock63⤵PID:1284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"64⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock65⤵PID:1748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"66⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock67⤵PID:3096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"68⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock69⤵PID:2920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"70⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock71⤵PID:3984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"72⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock73⤵PID:396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"74⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock75⤵PID:208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"76⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock77⤵PID:4724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"78⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock79⤵PID:2144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"80⤵PID:540
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:3468
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock81⤵PID:2300
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"82⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock83⤵PID:2512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"84⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock85⤵PID:4500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"86⤵PID:632
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:1920
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock87⤵PID:2332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"88⤵PID:4788
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:1748
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock89⤵PID:4280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"90⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock91⤵PID:3964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"92⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock93⤵PID:2540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"94⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock95⤵PID:436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"96⤵PID:4976
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵PID:3652
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock97⤵PID:3328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"98⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock99⤵PID:3564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"100⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock101⤵PID:5060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"102⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock103⤵PID:512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"104⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock105⤵PID:3048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"106⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock107⤵PID:4656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"108⤵PID:3068
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock109⤵PID:1920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"110⤵PID:4136
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:4264
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock111⤵PID:1524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"112⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock113⤵PID:216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"114⤵PID:540
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:3964
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock115⤵PID:4488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"116⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock117⤵PID:2552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"118⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock119⤵PID:1236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"120⤵PID:3140
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵PID:1320
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock121⤵PID:4484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_8227145fd2cb70f9e2b1284a1e764b40_virlock"122⤵PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-