Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe
-
Size
196KB
-
MD5
7c0591bb11e45afbd3ddd4521ca46791
-
SHA1
59b5453b71086aeaf1012f45d335374a2f13133c
-
SHA256
ae4cfb406afe9f575189804fde9c3abef45fa5020398938529fe17c9ec66daf3
-
SHA512
c9418951b095241926f048768de341035e8ed84c1a4cb644f450201baa7861cfb68f0d759e14e353f5deb37104b12aa64ded777da37b1aadf690a1f44a4b243b
-
SSDEEP
6144:sRBqTFl1qQ1K0+V6SW5pY8i3ktNoz0ul:8qjwQ1K0XektN+0u
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (56) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\International\Geo\Nation HCAIUwok.exe -
Executes dropped EXE 2 IoCs
pid Process 1184 HCAIUwok.exe 3024 qOMwoUcw.exe -
Loads dropped DLL 20 IoCs
pid Process 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\HCAIUwok.exe = "C:\\Users\\Admin\\nUMIUkIM\\HCAIUwok.exe" HCAIUwok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qOMwoUcw.exe = "C:\\ProgramData\\wCMYIAcM\\qOMwoUcw.exe" qOMwoUcw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\HCAIUwok.exe = "C:\\Users\\Admin\\nUMIUkIM\\HCAIUwok.exe" 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qOMwoUcw.exe = "C:\\ProgramData\\wCMYIAcM\\qOMwoUcw.exe" 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico HCAIUwok.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 2412 reg.exe 828 reg.exe 628 reg.exe 3016 reg.exe 812 reg.exe 896 reg.exe 1476 reg.exe 2840 reg.exe 2764 reg.exe 2528 reg.exe 1996 reg.exe 2972 reg.exe 1648 reg.exe 2556 reg.exe 2136 reg.exe 532 reg.exe 2696 reg.exe 2124 reg.exe 2904 reg.exe 2788 reg.exe 2804 reg.exe 3032 reg.exe 876 reg.exe 2728 reg.exe 2768 reg.exe 2472 reg.exe 1720 reg.exe 928 reg.exe 2228 reg.exe 2844 reg.exe 2612 reg.exe 1800 reg.exe 1624 reg.exe 732 reg.exe 2760 reg.exe 2300 reg.exe 1784 reg.exe 1576 reg.exe 2792 reg.exe 2540 reg.exe 1592 reg.exe 1984 reg.exe 1984 reg.exe 1088 reg.exe 1028 reg.exe 1348 reg.exe 2540 reg.exe 2104 reg.exe 2556 reg.exe 2300 reg.exe 1932 reg.exe 2764 reg.exe 2260 reg.exe 580 reg.exe 1756 reg.exe 684 reg.exe 1716 reg.exe 2724 reg.exe 1796 reg.exe 1076 reg.exe 1604 reg.exe 2748 reg.exe 2436 reg.exe 344 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1568 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1568 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1532 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1532 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1488 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1488 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1632 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1632 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2596 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2596 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2868 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2868 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1940 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1940 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 560 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 560 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1308 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1308 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1144 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1144 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2228 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2228 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2540 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2540 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1640 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1640 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2368 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2368 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1580 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1580 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 484 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 484 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1564 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1564 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2016 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2016 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1964 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1964 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2892 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2892 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 984 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 984 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1368 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 1368 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2880 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2880 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2620 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2620 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 896 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 896 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2812 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2812 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2108 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2108 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2156 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2156 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2448 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2448 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2644 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 2644 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1184 HCAIUwok.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe 1184 HCAIUwok.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 1184 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 28 PID 1252 wrote to memory of 1184 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 28 PID 1252 wrote to memory of 1184 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 28 PID 1252 wrote to memory of 1184 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 28 PID 1252 wrote to memory of 3024 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 29 PID 1252 wrote to memory of 3024 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 29 PID 1252 wrote to memory of 3024 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 29 PID 1252 wrote to memory of 3024 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 29 PID 1252 wrote to memory of 2768 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 30 PID 1252 wrote to memory of 2768 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 30 PID 1252 wrote to memory of 2768 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 30 PID 1252 wrote to memory of 2768 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 30 PID 1252 wrote to memory of 2876 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 32 PID 1252 wrote to memory of 2876 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 32 PID 1252 wrote to memory of 2876 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 32 PID 1252 wrote to memory of 2876 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 32 PID 2768 wrote to memory of 2668 2768 cmd.exe 33 PID 2768 wrote to memory of 2668 2768 cmd.exe 33 PID 2768 wrote to memory of 2668 2768 cmd.exe 33 PID 2768 wrote to memory of 2668 2768 cmd.exe 33 PID 1252 wrote to memory of 2664 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 34 PID 1252 wrote to memory of 2664 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 34 PID 1252 wrote to memory of 2664 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 34 PID 1252 wrote to memory of 2664 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 34 PID 1252 wrote to memory of 1148 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 36 PID 1252 wrote to memory of 1148 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 36 PID 1252 wrote to memory of 1148 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 36 PID 1252 wrote to memory of 1148 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 36 PID 1252 wrote to memory of 2844 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 37 PID 1252 wrote to memory of 2844 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 37 PID 1252 wrote to memory of 2844 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 37 PID 1252 wrote to memory of 2844 1252 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 37 PID 2844 wrote to memory of 2956 2844 cmd.exe 41 PID 2844 wrote to memory of 2956 2844 cmd.exe 41 PID 2844 wrote to memory of 2956 2844 cmd.exe 41 PID 2844 wrote to memory of 2956 2844 cmd.exe 41 PID 2668 wrote to memory of 2404 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 42 PID 2668 wrote to memory of 2404 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 42 PID 2668 wrote to memory of 2404 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 42 PID 2668 wrote to memory of 2404 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 42 PID 2404 wrote to memory of 1568 2404 cmd.exe 44 PID 2404 wrote to memory of 1568 2404 cmd.exe 44 PID 2404 wrote to memory of 1568 2404 cmd.exe 44 PID 2404 wrote to memory of 1568 2404 cmd.exe 44 PID 2668 wrote to memory of 1672 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 45 PID 2668 wrote to memory of 1672 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 45 PID 2668 wrote to memory of 1672 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 45 PID 2668 wrote to memory of 1672 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 45 PID 2668 wrote to memory of 1796 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 46 PID 2668 wrote to memory of 1796 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 46 PID 2668 wrote to memory of 1796 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 46 PID 2668 wrote to memory of 1796 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 46 PID 2668 wrote to memory of 1608 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 47 PID 2668 wrote to memory of 1608 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 47 PID 2668 wrote to memory of 1608 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 47 PID 2668 wrote to memory of 1608 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 47 PID 2668 wrote to memory of 1948 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 48 PID 2668 wrote to memory of 1948 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 48 PID 2668 wrote to memory of 1948 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 48 PID 2668 wrote to memory of 1948 2668 2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe 48 PID 1948 wrote to memory of 1984 1948 cmd.exe 53 PID 1948 wrote to memory of 1984 1948 cmd.exe 53 PID 1948 wrote to memory of 1984 1948 cmd.exe 53 PID 1948 wrote to memory of 1984 1948 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\nUMIUkIM\HCAIUwok.exe"C:\Users\Admin\nUMIUkIM\HCAIUwok.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1184
-
-
C:\ProgramData\wCMYIAcM\qOMwoUcw.exe"C:\ProgramData\wCMYIAcM\qOMwoUcw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3024
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"6⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1532 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"8⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"10⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"12⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"14⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"16⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"18⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:560 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"20⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1308 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"22⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1144 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"24⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2228 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"26⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2540 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"28⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"30⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2368 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"32⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"34⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:484 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"36⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:1564 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"38⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2016 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"40⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:1964 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"42⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"44⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:984 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"46⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:1368 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"48⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:2880 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"50⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"52⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:896 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"54⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"56⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:2108 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"58⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:2156 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"60⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2448 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"62⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2644 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"64⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock65⤵PID:2236
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"66⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock67⤵PID:2560
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"68⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock69⤵PID:1380
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"70⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock71⤵PID:1812
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"72⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock73⤵PID:568
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"74⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock75⤵PID:1292
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"76⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock77⤵PID:2604
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"78⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock79⤵PID:2576
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"80⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock81⤵PID:1616
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"82⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock83⤵PID:2360
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"84⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock85⤵PID:2388
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"86⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock87⤵PID:2256
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"88⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock89⤵PID:812
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"90⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock91⤵PID:3048
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"92⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock93⤵PID:316
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"94⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock95⤵PID:444
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"96⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock97⤵PID:484
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"98⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock99⤵PID:1664
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"100⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock101⤵PID:1512
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"102⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock103⤵PID:1760
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"104⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock105⤵PID:884
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"106⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock107⤵PID:868
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"108⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock109⤵PID:2256
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"110⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock111⤵PID:3064
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"112⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock113⤵PID:1432
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"114⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock115⤵PID:2328
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"116⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock117⤵PID:944
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"118⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock119⤵PID:2412
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"120⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock121⤵PID:1260
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-05-10_7c0591bb11e45afbd3ddd4521ca46791_virlock"122⤵PID:1700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-