Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe
-
Size
190KB
-
MD5
617e906c7eddc96288b409e78c1ec01c
-
SHA1
d13c9c42ac9adb825485c4dae87b50190413070d
-
SHA256
15dc6d8cd97ec807ed9c0f49499c7cdb89bfc1c8a9d0b2f5db0cd9ddc401596e
-
SHA512
cc9a02f2e038f4ac63af88bdb87bef569b62c5ab897bcfff8baa6f1750ee04408399ca34224c4020481ec0b8daa2e5620f68f8bd30d07e6ba9a4308f4cb29ebe
-
SSDEEP
3072:8U4+823/aJBn05lzpYhPYWVfWKBu80MBQPY4ppAeWjhJZTXHG6pC9mH:14+823/aJp0iYWVdBuEBOY4bpWjDZTXn
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (75) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation PeMswcoU.exe -
Executes dropped EXE 2 IoCs
pid Process 2604 EWoEssMw.exe 3068 PeMswcoU.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EWoEssMw.exe = "C:\\Users\\Admin\\hIsIQIQk\\EWoEssMw.exe" 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PeMswcoU.exe = "C:\\ProgramData\\eIckIQAg\\PeMswcoU.exe" 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PeMswcoU.exe = "C:\\ProgramData\\eIckIQAg\\PeMswcoU.exe" PeMswcoU.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EWoEssMw.exe = "C:\\Users\\Admin\\hIsIQIQk\\EWoEssMw.exe" EWoEssMw.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\shell32.dll.exe PeMswcoU.exe File created C:\Windows\SysWOW64\shell32.dll.exe PeMswcoU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 372 reg.exe 1348 reg.exe 1156 Process not Found 5100 reg.exe 2660 reg.exe 1040 reg.exe 4392 reg.exe 1660 reg.exe 1212 reg.exe 2828 reg.exe 1816 reg.exe 1120 Process not Found 5080 reg.exe 4308 reg.exe 3300 reg.exe 1248 reg.exe 4520 reg.exe 548 reg.exe 5048 reg.exe 3928 reg.exe 4080 reg.exe 1496 reg.exe 5068 reg.exe 5008 reg.exe 1224 reg.exe 1932 reg.exe 4644 Process not Found 856 reg.exe 4736 reg.exe 412 reg.exe 732 reg.exe 3920 Process not Found 880 reg.exe 4100 reg.exe 1464 reg.exe 3348 reg.exe 4464 Process not Found 808 reg.exe 4944 reg.exe 4600 reg.exe 2980 Process not Found 4924 reg.exe 1328 reg.exe 620 reg.exe 3600 reg.exe 2420 reg.exe 1752 reg.exe 372 Process not Found 1524 Process not Found 3140 reg.exe 3484 reg.exe 4808 reg.exe 4856 reg.exe 1400 reg.exe 4560 reg.exe 3412 Process not Found 1356 Process not Found 5020 reg.exe 936 reg.exe 2948 reg.exe 4352 reg.exe 3648 Process not Found 1400 reg.exe 4492 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2564 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2564 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2564 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2564 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3960 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3960 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3960 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3960 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1928 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1928 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1928 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1928 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 4580 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 4580 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 4580 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 4580 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1112 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1112 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1112 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 1112 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 5076 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 5076 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 5076 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 5076 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3708 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3708 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3708 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3708 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 4080 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 4080 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 4080 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 4080 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 976 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 976 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 976 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 976 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3296 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3296 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3296 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3296 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2412 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2412 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2412 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2412 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2084 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2084 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2084 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 2084 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3004 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3004 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3004 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 3004 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3068 PeMswcoU.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe 3068 PeMswcoU.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 2604 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 83 PID 224 wrote to memory of 2604 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 83 PID 224 wrote to memory of 2604 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 83 PID 224 wrote to memory of 3068 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 84 PID 224 wrote to memory of 3068 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 84 PID 224 wrote to memory of 3068 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 84 PID 224 wrote to memory of 1212 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 85 PID 224 wrote to memory of 1212 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 85 PID 224 wrote to memory of 1212 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 85 PID 1212 wrote to memory of 880 1212 cmd.exe 87 PID 1212 wrote to memory of 880 1212 cmd.exe 87 PID 1212 wrote to memory of 880 1212 cmd.exe 87 PID 224 wrote to memory of 1668 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 88 PID 224 wrote to memory of 1668 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 88 PID 224 wrote to memory of 1668 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 88 PID 224 wrote to memory of 5080 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 89 PID 224 wrote to memory of 5080 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 89 PID 224 wrote to memory of 5080 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 89 PID 224 wrote to memory of 4580 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 90 PID 224 wrote to memory of 4580 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 90 PID 224 wrote to memory of 4580 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 90 PID 224 wrote to memory of 3152 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 91 PID 224 wrote to memory of 3152 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 91 PID 224 wrote to memory of 3152 224 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 91 PID 880 wrote to memory of 3492 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 96 PID 880 wrote to memory of 3492 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 96 PID 880 wrote to memory of 3492 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 96 PID 3152 wrote to memory of 4476 3152 cmd.exe 98 PID 3152 wrote to memory of 4476 3152 cmd.exe 98 PID 3152 wrote to memory of 4476 3152 cmd.exe 98 PID 880 wrote to memory of 3260 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 99 PID 880 wrote to memory of 3260 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 99 PID 880 wrote to memory of 3260 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 99 PID 880 wrote to memory of 4956 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 100 PID 880 wrote to memory of 4956 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 100 PID 880 wrote to memory of 4956 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 100 PID 880 wrote to memory of 3928 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 101 PID 880 wrote to memory of 3928 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 101 PID 880 wrote to memory of 3928 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 101 PID 880 wrote to memory of 1560 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 102 PID 880 wrote to memory of 1560 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 102 PID 880 wrote to memory of 1560 880 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 102 PID 3492 wrote to memory of 964 3492 cmd.exe 107 PID 3492 wrote to memory of 964 3492 cmd.exe 107 PID 3492 wrote to memory of 964 3492 cmd.exe 107 PID 1560 wrote to memory of 1612 1560 cmd.exe 108 PID 1560 wrote to memory of 1612 1560 cmd.exe 108 PID 1560 wrote to memory of 1612 1560 cmd.exe 108 PID 964 wrote to memory of 3300 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 110 PID 964 wrote to memory of 3300 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 110 PID 964 wrote to memory of 3300 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 110 PID 3300 wrote to memory of 2564 3300 cmd.exe 112 PID 3300 wrote to memory of 2564 3300 cmd.exe 112 PID 3300 wrote to memory of 2564 3300 cmd.exe 112 PID 964 wrote to memory of 2972 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 113 PID 964 wrote to memory of 2972 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 113 PID 964 wrote to memory of 2972 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 113 PID 964 wrote to memory of 1328 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 114 PID 964 wrote to memory of 1328 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 114 PID 964 wrote to memory of 1328 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 114 PID 964 wrote to memory of 1312 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 115 PID 964 wrote to memory of 1312 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 115 PID 964 wrote to memory of 1312 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 115 PID 964 wrote to memory of 1124 964 2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\hIsIQIQk\EWoEssMw.exe"C:\Users\Admin\hIsIQIQk\EWoEssMw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2604
-
-
C:\ProgramData\eIckIQAg\PeMswcoU.exe"C:\ProgramData\eIckIQAg\PeMswcoU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"8⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"10⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"12⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"14⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"16⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"18⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"20⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"22⤵PID:4528
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵PID:4224
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"24⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"26⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"28⤵PID:3052
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵PID:4624
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"30⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"32⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock33⤵PID:2436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"34⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock35⤵PID:1516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"36⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock37⤵PID:768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"38⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock39⤵PID:3396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"40⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock41⤵PID:2484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"42⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock43⤵PID:1492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"44⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock45⤵PID:1124
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"46⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock47⤵PID:4108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"48⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock49⤵PID:3344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"50⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock51⤵PID:5084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"52⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock53⤵PID:1072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"54⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock55⤵PID:392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"56⤵PID:3888
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵PID:3816
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock57⤵PID:5100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"58⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock59⤵PID:1224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"60⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock61⤵PID:4348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"62⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock63⤵PID:1644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"64⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock65⤵PID:4328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"66⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock67⤵PID:2980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"68⤵PID:3052
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock69⤵PID:3396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"70⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock71⤵PID:1204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"72⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock73⤵PID:4256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"74⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock75⤵PID:4492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"76⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock77⤵PID:3096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"78⤵PID:1040
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock79⤵PID:1932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"80⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock81⤵PID:5068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"82⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock83⤵PID:1072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"84⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock85⤵PID:1800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"86⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock87⤵PID:2740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"88⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock89⤵PID:2084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"90⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock91⤵PID:4100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"92⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock93⤵PID:1732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"94⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock95⤵PID:1788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"96⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock97⤵PID:2484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"98⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock99⤵PID:2660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"100⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock101⤵PID:2376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"102⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock103⤵PID:3052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"104⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock105⤵PID:1612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"106⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock107⤵PID:4664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"108⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock109⤵PID:4352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"110⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock111⤵PID:5012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"112⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock113⤵PID:4836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"114⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock115⤵PID:2596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"116⤵PID:1504
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock117⤵PID:4880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"118⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock119⤵PID:4596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"120⤵PID:4372
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock121⤵PID:4836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-15_617e906c7eddc96288b409e78c1ec01c_virlock"122⤵PID:2036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-