Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe
-
Size
186KB
-
MD5
0eb102ecb51f8e10435254be3bf01205
-
SHA1
870d51046c2fb58036f64b8098f33bd3bee2f376
-
SHA256
d8a28b2bb503def54e8df385900178c4171a9001572d13404eb686374f03b53d
-
SHA512
82b3ff82abe178b2b7595044fbc7858a638f2d9ca4238e767ba1bf1fcc76c612b63a37976638b8f7d983eda9f3995cd698ca1d2bb7f287ef820e28189a556f3c
-
SSDEEP
3072:QEo6yybsJfVGZJFHK0hdpgydymuSKF2jCxqFLB4uWS:jo6RbsJNaXK0hdVdwl8OcLsS
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (89) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 4 IoCs
flow pid Process 41 3628 Process not Found 44 3628 Process not Found 48 3628 Process not Found 49 3628 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation IKIoAcQc.exe -
Executes dropped EXE 2 IoCs
pid Process 3020 HqgQsocY.exe 5076 IKIoAcQc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HqgQsocY.exe = "C:\\Users\\Admin\\eEEUAocQ\\HqgQsocY.exe" 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IKIoAcQc.exe = "C:\\ProgramData\\pkcUwQAA\\IKIoAcQc.exe" 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IKIoAcQc.exe = "C:\\ProgramData\\pkcUwQAA\\IKIoAcQc.exe" IKIoAcQc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HqgQsocY.exe = "C:\\Users\\Admin\\eEEUAocQ\\HqgQsocY.exe" HqgQsocY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 4332 reg.exe 3252 reg.exe 4400 reg.exe 2184 reg.exe 4692 reg.exe 2996 reg.exe 1596 reg.exe 4952 reg.exe 228 reg.exe 4452 Process not Found 4660 Process not Found 3136 reg.exe 1448 reg.exe 3136 reg.exe 4844 reg.exe 2208 Process not Found 1228 reg.exe 3772 reg.exe 2088 reg.exe 2524 Process not Found 2976 Process not Found 1424 reg.exe 3808 reg.exe 3516 reg.exe 4716 reg.exe 1572 reg.exe 944 reg.exe 1824 reg.exe 2328 reg.exe 2184 reg.exe 1404 reg.exe 5020 Process not Found 2172 Process not Found 4952 reg.exe 1296 reg.exe 2096 reg.exe 2192 reg.exe 2768 reg.exe 3252 reg.exe 3548 reg.exe 1064 reg.exe 1832 Process not Found 1824 reg.exe 3144 reg.exe 3952 Process not Found 3364 reg.exe 3484 Process not Found 3620 reg.exe 4076 reg.exe 2768 reg.exe 4684 reg.exe 2456 reg.exe 4684 reg.exe 4028 reg.exe 3548 reg.exe 2284 reg.exe 3432 reg.exe 3940 reg.exe 4892 reg.exe 4928 reg.exe 436 reg.exe 3364 reg.exe 2484 Process not Found 4844 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3384 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3384 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3384 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3384 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3960 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3960 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3960 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3960 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2632 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2632 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2632 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2632 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 5112 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 5112 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 5112 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 5112 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1536 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1536 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1536 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1536 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3712 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3712 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3712 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3712 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2632 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2632 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2632 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2632 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2140 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2140 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2140 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 2140 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1308 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1308 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1308 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 1308 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3408 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3408 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3408 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3408 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3896 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3896 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3896 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 3896 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 4716 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 4716 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 4716 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 4716 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 4568 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 4568 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 4568 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 4568 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5076 IKIoAcQc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe 5076 IKIoAcQc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1012 wrote to memory of 3020 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 90 PID 1012 wrote to memory of 3020 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 90 PID 1012 wrote to memory of 3020 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 90 PID 1012 wrote to memory of 5076 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 91 PID 1012 wrote to memory of 5076 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 91 PID 1012 wrote to memory of 5076 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 91 PID 1012 wrote to memory of 552 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 92 PID 1012 wrote to memory of 552 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 92 PID 1012 wrote to memory of 552 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 92 PID 1012 wrote to memory of 1320 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 94 PID 1012 wrote to memory of 1320 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 94 PID 1012 wrote to memory of 1320 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 94 PID 1012 wrote to memory of 1000 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 95 PID 1012 wrote to memory of 1000 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 95 PID 1012 wrote to memory of 1000 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 95 PID 1012 wrote to memory of 664 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 96 PID 1012 wrote to memory of 664 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 96 PID 1012 wrote to memory of 664 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 96 PID 1012 wrote to memory of 4232 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 97 PID 1012 wrote to memory of 4232 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 97 PID 1012 wrote to memory of 4232 1012 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 97 PID 552 wrote to memory of 1296 552 cmd.exe 102 PID 552 wrote to memory of 1296 552 cmd.exe 102 PID 552 wrote to memory of 1296 552 cmd.exe 102 PID 4232 wrote to memory of 5000 4232 cmd.exe 103 PID 4232 wrote to memory of 5000 4232 cmd.exe 103 PID 4232 wrote to memory of 5000 4232 cmd.exe 103 PID 1296 wrote to memory of 3380 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 104 PID 1296 wrote to memory of 3380 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 104 PID 1296 wrote to memory of 3380 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 104 PID 1296 wrote to memory of 2524 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 106 PID 1296 wrote to memory of 2524 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 106 PID 1296 wrote to memory of 2524 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 106 PID 1296 wrote to memory of 448 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 107 PID 1296 wrote to memory of 448 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 107 PID 1296 wrote to memory of 448 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 107 PID 1296 wrote to memory of 1436 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 108 PID 1296 wrote to memory of 1436 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 108 PID 1296 wrote to memory of 1436 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 108 PID 1296 wrote to memory of 4508 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 109 PID 1296 wrote to memory of 4508 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 109 PID 1296 wrote to memory of 4508 1296 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 109 PID 3380 wrote to memory of 5068 3380 cmd.exe 114 PID 3380 wrote to memory of 5068 3380 cmd.exe 114 PID 3380 wrote to memory of 5068 3380 cmd.exe 114 PID 4508 wrote to memory of 2156 4508 cmd.exe 115 PID 4508 wrote to memory of 2156 4508 cmd.exe 115 PID 4508 wrote to memory of 2156 4508 cmd.exe 115 PID 5068 wrote to memory of 1840 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 117 PID 5068 wrote to memory of 1840 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 117 PID 5068 wrote to memory of 1840 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 117 PID 1840 wrote to memory of 3384 1840 cmd.exe 120 PID 1840 wrote to memory of 3384 1840 cmd.exe 120 PID 1840 wrote to memory of 3384 1840 cmd.exe 120 PID 5068 wrote to memory of 1060 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 121 PID 5068 wrote to memory of 1060 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 121 PID 5068 wrote to memory of 1060 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 121 PID 5068 wrote to memory of 4088 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 122 PID 5068 wrote to memory of 4088 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 122 PID 5068 wrote to memory of 4088 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 122 PID 5068 wrote to memory of 2564 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 123 PID 5068 wrote to memory of 2564 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 123 PID 5068 wrote to memory of 2564 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 123 PID 5068 wrote to memory of 4816 5068 2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\eEEUAocQ\HqgQsocY.exe"C:\Users\Admin\eEEUAocQ\HqgQsocY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3020
-
-
C:\ProgramData\pkcUwQAA\IKIoAcQc.exe"C:\ProgramData\pkcUwQAA\IKIoAcQc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"8⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"10⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"12⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"14⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"16⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"18⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"20⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"22⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"24⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"26⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"28⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"30⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"32⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock33⤵PID:5020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"34⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock35⤵PID:2096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"36⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock37⤵PID:4568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"38⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock39⤵PID:608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"40⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock41⤵PID:2624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"42⤵PID:3896
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵PID:4880
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock43⤵PID:4452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"44⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock45⤵PID:1356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"46⤵PID:664
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵PID:2096
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock47⤵PID:4400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"48⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock49⤵PID:4572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"50⤵PID:3952
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵PID:3772
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock51⤵PID:1192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"52⤵PID:3216
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵PID:4896
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock53⤵PID:4376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"54⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock55⤵PID:5044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"56⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock57⤵PID:2128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"58⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock59⤵PID:944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"60⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock61⤵PID:1356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"62⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock63⤵PID:4792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"64⤵PID:2440
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:2324
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock65⤵PID:4452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"66⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock67⤵PID:448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"68⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock69⤵PID:3024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"70⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock71⤵PID:4516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"72⤵PID:2208
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵PID:3728
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock73⤵PID:3644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"74⤵PID:2132
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵PID:4840
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock75⤵PID:4952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"76⤵PID:1436
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵PID:4736
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock77⤵PID:2692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"78⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock79⤵PID:3668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"80⤵PID:1356
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:4452
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock81⤵PID:3956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"82⤵PID:2912
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock83⤵PID:3808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"84⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock85⤵PID:4792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"86⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock87⤵PID:1368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"88⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock89⤵PID:4840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"90⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock91⤵PID:3444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"92⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock93⤵PID:2956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"94⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock95⤵PID:4588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"96⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock97⤵PID:1004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"98⤵PID:448
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:2264
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock99⤵PID:1888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"100⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock101⤵PID:2192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"102⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock103⤵PID:2768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"104⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock105⤵PID:4000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"106⤵PID:920
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:4952
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock107⤵PID:1644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"108⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock109⤵PID:4076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"110⤵PID:3620
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:3644
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock111⤵PID:4452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"112⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock113⤵PID:4232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"114⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock115⤵PID:4268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"116⤵PID:5068
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:4304
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock117⤵PID:4260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"118⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock119⤵PID:956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"120⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock121⤵PID:1356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-16_0eb102ecb51f8e10435254be3bf01205_virlock"122⤵PID:2976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-