Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
65s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe
-
Size
123KB
-
MD5
139918518fe0162c1ee92388bb5a7ce0
-
SHA1
3aa3e8f262ba0b1f77463bb828110909b705f5be
-
SHA256
63b309b5e85517ea2db32813bc5d5e504a9548f3d29b5dd88aaa4c5e97e766d6
-
SHA512
20e506cd05a7339e73ef2f6233943143a00294e5079983ba07d00ad6608b73fa2e0d1b611e511b92921792e85732934f654bd3515707d76c28185fd191398cf3
-
SSDEEP
3072:KprT5ike9IExce31FR6dy6wDY27MwlWqlWqlWqlWqlWqlWqlWqlWqlWqlW9:KpQ9Ile31Fwjw02YwPPPPPPPPPS
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (84) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation eYMcoYAc.exe -
Executes dropped EXE 2 IoCs
pid Process 3340 eYMcoYAc.exe 3692 RIgcAcEY.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eYMcoYAc.exe = "C:\\Users\\Admin\\IyYEscMc\\eYMcoYAc.exe" 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RIgcAcEY.exe = "C:\\ProgramData\\iQMMQEUU\\RIgcAcEY.exe" 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eYMcoYAc.exe = "C:\\Users\\Admin\\IyYEscMc\\eYMcoYAc.exe" eYMcoYAc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RIgcAcEY.exe = "C:\\ProgramData\\iQMMQEUU\\RIgcAcEY.exe" RIgcAcEY.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kYAQcYow.exe = "C:\\Users\\Admin\\UyAgEcoo\\kYAQcYow.exe" 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owEMYEoY.exe = "C:\\ProgramData\\cuMYwIcU\\owEMYEoY.exe" 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe eYMcoYAc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3932 3984 WerFault.exe 987 3020 4064 WerFault.exe 988 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 1732 reg.exe 4860 reg.exe 2996 reg.exe 1032 reg.exe 2608 reg.exe 460 reg.exe 2508 reg.exe 1468 reg.exe 1432 reg.exe 3628 reg.exe 4968 reg.exe 2104 reg.exe 3664 reg.exe 2244 reg.exe 2620 reg.exe 3100 reg.exe 1580 reg.exe 2568 reg.exe 1364 reg.exe 3644 reg.exe 4528 reg.exe 3356 reg.exe 3276 reg.exe 428 reg.exe 1232 reg.exe 1468 reg.exe 3088 reg.exe 2488 reg.exe 4636 reg.exe 512 reg.exe 4840 reg.exe 4036 reg.exe 1768 reg.exe 1900 reg.exe 4760 reg.exe 2444 reg.exe 4116 reg.exe 3920 reg.exe 5112 reg.exe 1580 reg.exe 3644 reg.exe 4260 reg.exe 3020 reg.exe 3292 reg.exe 4968 reg.exe 3616 reg.exe 4336 reg.exe 1372 reg.exe 3180 reg.exe 4424 reg.exe 3216 reg.exe 2616 reg.exe 4672 reg.exe 4424 reg.exe 3920 reg.exe 612 reg.exe 3628 reg.exe 1888 reg.exe 4888 reg.exe 4404 reg.exe 4456 reg.exe 4060 reg.exe 5068 reg.exe 380 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2580 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2580 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2580 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2580 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3956 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3956 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3956 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 3956 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2492 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2492 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2492 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2492 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 1764 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 1764 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 1764 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 1764 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4940 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4940 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4940 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4940 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2704 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2704 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2704 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2704 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4432 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4432 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4432 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4432 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4812 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4812 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4812 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 4812 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2252 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2252 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2252 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2252 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2248 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2248 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2248 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 2248 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 952 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 952 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 952 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 952 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 1124 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 1124 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 1124 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 1124 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 5096 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 5096 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 5096 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 5096 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3340 eYMcoYAc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe 3340 eYMcoYAc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4048 wrote to memory of 3340 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 84 PID 4048 wrote to memory of 3340 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 84 PID 4048 wrote to memory of 3340 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 84 PID 4048 wrote to memory of 3692 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 85 PID 4048 wrote to memory of 3692 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 85 PID 4048 wrote to memory of 3692 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 85 PID 4048 wrote to memory of 4000 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 86 PID 4048 wrote to memory of 4000 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 86 PID 4048 wrote to memory of 4000 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 86 PID 4048 wrote to memory of 3276 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 89 PID 4048 wrote to memory of 3276 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 89 PID 4048 wrote to memory of 3276 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 89 PID 4048 wrote to memory of 2084 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 91 PID 4048 wrote to memory of 2084 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 91 PID 4048 wrote to memory of 2084 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 91 PID 4000 wrote to memory of 3212 4000 cmd.exe 90 PID 4000 wrote to memory of 3212 4000 cmd.exe 90 PID 4000 wrote to memory of 3212 4000 cmd.exe 90 PID 4048 wrote to memory of 5048 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 92 PID 4048 wrote to memory of 5048 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 92 PID 4048 wrote to memory of 5048 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 92 PID 4048 wrote to memory of 1732 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 93 PID 4048 wrote to memory of 1732 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 93 PID 4048 wrote to memory of 1732 4048 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 93 PID 1732 wrote to memory of 4800 1732 cmd.exe 98 PID 1732 wrote to memory of 4800 1732 cmd.exe 98 PID 1732 wrote to memory of 4800 1732 cmd.exe 98 PID 3212 wrote to memory of 4192 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 99 PID 3212 wrote to memory of 4192 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 99 PID 3212 wrote to memory of 4192 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 99 PID 4192 wrote to memory of 3224 4192 cmd.exe 101 PID 4192 wrote to memory of 3224 4192 cmd.exe 101 PID 4192 wrote to memory of 3224 4192 cmd.exe 101 PID 3212 wrote to memory of 3260 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 102 PID 3212 wrote to memory of 3260 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 102 PID 3212 wrote to memory of 3260 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 102 PID 3212 wrote to memory of 1252 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 103 PID 3212 wrote to memory of 1252 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 103 PID 3212 wrote to memory of 1252 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 103 PID 3212 wrote to memory of 4140 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 104 PID 3212 wrote to memory of 4140 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 104 PID 3212 wrote to memory of 4140 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 104 PID 3212 wrote to memory of 5104 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 105 PID 3212 wrote to memory of 5104 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 105 PID 3212 wrote to memory of 5104 3212 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 105 PID 5104 wrote to memory of 4880 5104 cmd.exe 110 PID 5104 wrote to memory of 4880 5104 cmd.exe 110 PID 5104 wrote to memory of 4880 5104 cmd.exe 110 PID 3224 wrote to memory of 4568 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 111 PID 3224 wrote to memory of 4568 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 111 PID 3224 wrote to memory of 4568 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 111 PID 4568 wrote to memory of 2580 4568 cmd.exe 113 PID 4568 wrote to memory of 2580 4568 cmd.exe 113 PID 4568 wrote to memory of 2580 4568 cmd.exe 113 PID 3224 wrote to memory of 1488 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 114 PID 3224 wrote to memory of 1488 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 114 PID 3224 wrote to memory of 1488 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 114 PID 3224 wrote to memory of 3020 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 115 PID 3224 wrote to memory of 3020 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 115 PID 3224 wrote to memory of 3020 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 115 PID 3224 wrote to memory of 4660 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 116 PID 3224 wrote to memory of 4660 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 116 PID 3224 wrote to memory of 4660 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 116 PID 3224 wrote to memory of 840 3224 2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\IyYEscMc\eYMcoYAc.exe"C:\Users\Admin\IyYEscMc\eYMcoYAc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3340
-
-
C:\ProgramData\iQMMQEUU\RIgcAcEY.exe"C:\ProgramData\iQMMQEUU\RIgcAcEY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"8⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"10⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"12⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"14⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"16⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"18⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"20⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"22⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"24⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"26⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"28⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"30⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"32⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock33⤵PID:2428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"34⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock35⤵PID:4772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"36⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock37⤵PID:2840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"38⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock39⤵PID:3512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"40⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock41⤵PID:608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"42⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock43⤵PID:1344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"44⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock45⤵PID:4600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"46⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock47⤵PID:2104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"48⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock49⤵PID:2456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"50⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock51⤵PID:2756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"52⤵PID:1896
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵PID:4868
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock53⤵PID:2680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"54⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock55⤵PID:4900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"56⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock57⤵PID:3636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"58⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock59⤵PID:1784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"60⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock61⤵PID:1428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"62⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock63⤵PID:4740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"64⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock65⤵PID:4136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"66⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock67⤵PID:5096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"68⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock69⤵PID:464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"70⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock71⤵PID:4936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"72⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock73⤵PID:3960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"74⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock75⤵PID:560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"76⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock77⤵PID:1420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"78⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock79⤵PID:1176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"80⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock81⤵PID:1432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"82⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock83⤵PID:3104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"84⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock85⤵PID:4624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"86⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock87⤵PID:1428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"88⤵PID:3624
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:3216
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock89⤵PID:1420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"90⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock91⤵PID:5096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"92⤵PID:344
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵PID:464
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock93⤵PID:3952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"94⤵PID:4384
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵PID:4124
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock95⤵PID:5112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"96⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock97⤵PID:4500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"98⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock99⤵PID:3220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"100⤵PID:2084
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵PID:1372
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock101⤵PID:3308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"102⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock103⤵PID:3612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"104⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock105⤵PID:344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"106⤵PID:956
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:8
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock107⤵PID:3556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"108⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock109⤵PID:3960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"110⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock111⤵PID:1352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"112⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock113⤵PID:2572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"114⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock115⤵PID:3900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"116⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock117⤵PID:2320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"118⤵PID:4756
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵PID:1244
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock119⤵PID:4116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"120⤵PID:668
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵PID:544
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock121⤵PID:4980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-11_139918518fe0162c1ee92388bb5a7ce0_virlock"122⤵PID:384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-