Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 22:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe
-
Size
117KB
-
MD5
8f12f6672e3a30bea49592af840f6d93
-
SHA1
b67d1459060b1d16917d68151e64c4286fbe91c2
-
SHA256
3c7abd7432b74c6f258cf94c6ced8ead24d75fdd98290ac4a8b794839a6971c9
-
SHA512
36330d2ec44307aae5db01055d104b4c20525f0a7614aaa9c9bb1233d59e00f36788fd59a224cc154f425239a6bde5e85e4a1fea3230857a75e90fa53d6b2c03
-
SSDEEP
3072:9X75hp2S75mWgAs68JNkl98pMT8DzZ1y3K9Hk0:N75hDdmDv68JNkl98zykr
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (85) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation KgYIQMgU.exe -
Executes dropped EXE 2 IoCs
pid Process 2332 KgYIQMgU.exe 876 aMgQsAMs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KgYIQMgU.exe = "C:\\Users\\Admin\\NgoEwkUM\\KgYIQMgU.exe" 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aMgQsAMs.exe = "C:\\ProgramData\\AaMokgYk\\aMgQsAMs.exe" 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KgYIQMgU.exe = "C:\\Users\\Admin\\NgoEwkUM\\KgYIQMgU.exe" KgYIQMgU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aMgQsAMs.exe = "C:\\ProgramData\\AaMokgYk\\aMgQsAMs.exe" aMgQsAMs.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe KgYIQMgU.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe KgYIQMgU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 1260 reg.exe 2940 reg.exe 1948 reg.exe 4660 reg.exe 1056 reg.exe 904 reg.exe 1388 reg.exe 3476 reg.exe 2000 reg.exe 4540 reg.exe 4384 reg.exe 2260 reg.exe 5060 reg.exe 2880 reg.exe 4072 reg.exe 4620 reg.exe 4832 reg.exe 2220 reg.exe 3704 reg.exe 2616 reg.exe 4184 reg.exe 2060 reg.exe 1256 reg.exe 3560 reg.exe 2756 reg.exe 4908 reg.exe 4344 reg.exe 3196 reg.exe 3792 reg.exe 392 reg.exe 1264 reg.exe 2772 reg.exe 2864 reg.exe 4072 reg.exe 960 reg.exe 4184 reg.exe 3304 reg.exe 2900 reg.exe 3684 reg.exe 2060 reg.exe 4332 reg.exe 1124 reg.exe 2356 reg.exe 2960 reg.exe 4428 reg.exe 4516 reg.exe 376 reg.exe 1632 reg.exe 2492 reg.exe 3812 reg.exe 1672 reg.exe 2560 reg.exe 932 reg.exe 4648 reg.exe 1060 reg.exe 2828 reg.exe 4148 reg.exe 3696 reg.exe 1408 reg.exe 4268 reg.exe 2136 reg.exe 1528 reg.exe 2804 reg.exe 1052 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4684 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4684 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4684 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4684 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 5004 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 5004 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 5004 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 5004 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4580 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4580 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4580 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4580 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4640 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4640 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4640 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4640 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 972 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 972 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 972 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 972 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2092 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2092 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2092 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2092 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4420 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4420 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4420 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4420 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4148 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4148 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4148 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 4148 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 3512 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 3512 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 3512 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 3512 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2616 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2616 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2616 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 2616 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 3096 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 3096 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 3096 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 3096 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 1380 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 1380 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 1380 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 1380 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 1660 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 1660 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 1660 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 1660 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2332 KgYIQMgU.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe 2332 KgYIQMgU.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4788 wrote to memory of 2332 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 83 PID 4788 wrote to memory of 2332 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 83 PID 4788 wrote to memory of 2332 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 83 PID 4788 wrote to memory of 876 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 84 PID 4788 wrote to memory of 876 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 84 PID 4788 wrote to memory of 876 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 84 PID 4788 wrote to memory of 8 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 85 PID 4788 wrote to memory of 8 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 85 PID 4788 wrote to memory of 8 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 85 PID 8 wrote to memory of 2112 8 cmd.exe 87 PID 8 wrote to memory of 2112 8 cmd.exe 87 PID 8 wrote to memory of 2112 8 cmd.exe 87 PID 4788 wrote to memory of 4652 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 88 PID 4788 wrote to memory of 4652 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 88 PID 4788 wrote to memory of 4652 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 88 PID 4788 wrote to memory of 4620 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 89 PID 4788 wrote to memory of 4620 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 89 PID 4788 wrote to memory of 4620 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 89 PID 4788 wrote to memory of 2088 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 90 PID 4788 wrote to memory of 2088 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 90 PID 4788 wrote to memory of 2088 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 90 PID 4788 wrote to memory of 3512 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 91 PID 4788 wrote to memory of 3512 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 91 PID 4788 wrote to memory of 3512 4788 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 91 PID 3512 wrote to memory of 4228 3512 cmd.exe 96 PID 3512 wrote to memory of 4228 3512 cmd.exe 96 PID 3512 wrote to memory of 4228 3512 cmd.exe 96 PID 2112 wrote to memory of 3932 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 97 PID 2112 wrote to memory of 3932 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 97 PID 2112 wrote to memory of 3932 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 97 PID 3932 wrote to memory of 5016 3932 cmd.exe 100 PID 3932 wrote to memory of 5016 3932 cmd.exe 100 PID 3932 wrote to memory of 5016 3932 cmd.exe 100 PID 2112 wrote to memory of 4744 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 101 PID 2112 wrote to memory of 4744 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 101 PID 2112 wrote to memory of 4744 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 101 PID 2112 wrote to memory of 1260 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 102 PID 2112 wrote to memory of 1260 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 102 PID 2112 wrote to memory of 1260 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 102 PID 2112 wrote to memory of 2024 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 103 PID 2112 wrote to memory of 2024 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 103 PID 2112 wrote to memory of 2024 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 103 PID 2112 wrote to memory of 5112 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 104 PID 2112 wrote to memory of 5112 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 104 PID 2112 wrote to memory of 5112 2112 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 104 PID 5112 wrote to memory of 4004 5112 cmd.exe 109 PID 5112 wrote to memory of 4004 5112 cmd.exe 109 PID 5112 wrote to memory of 4004 5112 cmd.exe 109 PID 5016 wrote to memory of 4196 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 110 PID 5016 wrote to memory of 4196 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 110 PID 5016 wrote to memory of 4196 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 110 PID 4196 wrote to memory of 4684 4196 cmd.exe 112 PID 4196 wrote to memory of 4684 4196 cmd.exe 112 PID 4196 wrote to memory of 4684 4196 cmd.exe 112 PID 5016 wrote to memory of 4136 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 113 PID 5016 wrote to memory of 4136 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 113 PID 5016 wrote to memory of 4136 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 113 PID 5016 wrote to memory of 724 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 114 PID 5016 wrote to memory of 724 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 114 PID 5016 wrote to memory of 724 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 114 PID 5016 wrote to memory of 880 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 115 PID 5016 wrote to memory of 880 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 115 PID 5016 wrote to memory of 880 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 115 PID 5016 wrote to memory of 1948 5016 2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\NgoEwkUM\KgYIQMgU.exe"C:\Users\Admin\NgoEwkUM\KgYIQMgU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2332
-
-
C:\ProgramData\AaMokgYk\aMgQsAMs.exe"C:\ProgramData\AaMokgYk\aMgQsAMs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:876
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"8⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"10⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"12⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"14⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"16⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"18⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"20⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"22⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"24⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"26⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"28⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"30⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"32⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock33⤵PID:4840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"34⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock35⤵PID:2804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"36⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock37⤵PID:4376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"38⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock39⤵PID:1964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"40⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock41⤵PID:2308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"42⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock43⤵PID:4472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"44⤵PID:4640
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵PID:4004
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock45⤵PID:880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"46⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock47⤵PID:1832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"48⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock49⤵PID:2932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"50⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock51⤵PID:3252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"52⤵PID:4384
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵PID:1400
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock53⤵PID:3704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"54⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock55⤵PID:3012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"56⤵PID:2060
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵PID:3912
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock57⤵PID:2196
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"58⤵PID:4548
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵PID:3400
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock59⤵PID:972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"60⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock61⤵PID:2960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"62⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock63⤵PID:3096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"64⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock65⤵PID:4120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"66⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock67⤵PID:4828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"68⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock69⤵PID:4672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"70⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock71⤵PID:4444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"72⤵PID:1528
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵PID:4336
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock73⤵PID:4448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"74⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock75⤵PID:4752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"76⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock77⤵PID:3512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"78⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock79⤵PID:1324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"80⤵PID:1364
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:972
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock81⤵PID:1580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"82⤵PID:716
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:3736
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock83⤵PID:2200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"84⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock85⤵PID:1396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"86⤵PID:992
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:3264
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock87⤵PID:5004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"88⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock89⤵PID:392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"90⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock91⤵PID:4752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"92⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock93⤵PID:4000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"94⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock95⤵PID:2900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"96⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock97⤵PID:2512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"98⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock99⤵PID:4920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"100⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock101⤵PID:1964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"102⤵PID:2616
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵PID:2196
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock103⤵PID:1832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"104⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock105⤵PID:3908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"106⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock107⤵PID:8
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"108⤵PID:1248
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:5060
-
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock109⤵PID:4784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"110⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock111⤵PID:4076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"112⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock113⤵PID:3304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"114⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock115⤵PID:4540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"116⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock117⤵PID:3240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"118⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock119⤵PID:4448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"120⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock121⤵PID:2588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-21_8f12f6672e3a30bea49592af840f6d93_virlock"122⤵PID:4268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-