Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 10:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe
-
Size
110KB
-
MD5
53a32a986cfc4b18a304933cb020c464
-
SHA1
9bd80e1ea6db25cde4c9a6875ddc9268d82e308d
-
SHA256
260344e308e8c79176b2977435e4878b150ae108ec3314ec5be07cd32139c643
-
SHA512
f91521abab684d7e7e906389095d655fb8d44c901c160045016bde7c6fe1f3cbd389cffc11090db753ae7fd3bcb33d9814e0b30d16cc7bd908a4a160995cb2da
-
SSDEEP
3072:CoS4wVGQkKPz2fMfqr59JdxavuQyIqiIrINkBH8dE:CdVvCMMdEvuQyBiIrskBHg
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (76) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation SIkkYEYo.exe -
Executes dropped EXE 2 IoCs
pid Process 732 SIkkYEYo.exe 4380 VuQYEUYw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIkkYEYo.exe = "C:\\Users\\Admin\\kQUcMowc\\SIkkYEYo.exe" 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VuQYEUYw.exe = "C:\\ProgramData\\aQAYIows\\VuQYEUYw.exe" 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIkkYEYo.exe = "C:\\Users\\Admin\\kQUcMowc\\SIkkYEYo.exe" SIkkYEYo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VuQYEUYw.exe = "C:\\ProgramData\\aQAYIows\\VuQYEUYw.exe" VuQYEUYw.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe SIkkYEYo.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe SIkkYEYo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 2704 reg.exe 4840 reg.exe 4600 reg.exe 2140 reg.exe 456 reg.exe 2836 reg.exe 2784 reg.exe 3380 reg.exe 1068 reg.exe 4044 reg.exe 4800 reg.exe 2556 reg.exe 4072 reg.exe 1208 reg.exe 4860 reg.exe 2568 reg.exe 4144 reg.exe 2928 reg.exe 1924 reg.exe 4560 reg.exe 4816 reg.exe 1964 reg.exe 3836 reg.exe 1252 reg.exe 4304 reg.exe 392 reg.exe 3128 reg.exe 4768 reg.exe 5048 reg.exe 4144 reg.exe 4092 reg.exe 2996 reg.exe 620 reg.exe 1892 reg.exe 4144 reg.exe 4444 reg.exe 3604 reg.exe 4224 reg.exe 1008 reg.exe 2880 reg.exe 1192 reg.exe 1872 reg.exe 3640 reg.exe 4252 reg.exe 2936 reg.exe 3264 reg.exe 4488 reg.exe 1852 reg.exe 4192 reg.exe 1556 reg.exe 4952 reg.exe 4332 reg.exe 680 reg.exe 2756 reg.exe 1408 reg.exe 4604 reg.exe 892 reg.exe 4084 reg.exe 5028 reg.exe 4616 reg.exe 3776 reg.exe 4680 reg.exe 2868 reg.exe 4684 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1644 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1644 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1644 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1644 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2732 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2732 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2732 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2732 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4740 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4740 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4740 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4740 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4456 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4456 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4456 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4456 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4856 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4856 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4856 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4856 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1408 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1408 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1408 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1408 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2628 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2628 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2628 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2628 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4092 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4092 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4092 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4092 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4840 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4840 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4840 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4840 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1600 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1600 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1600 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 1600 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4512 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4512 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4512 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 4512 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2600 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2600 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2600 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 2600 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 732 SIkkYEYo.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe 732 SIkkYEYo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4756 wrote to memory of 732 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 83 PID 4756 wrote to memory of 732 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 83 PID 4756 wrote to memory of 732 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 83 PID 4756 wrote to memory of 4380 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 84 PID 4756 wrote to memory of 4380 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 84 PID 4756 wrote to memory of 4380 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 84 PID 4756 wrote to memory of 3400 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 85 PID 4756 wrote to memory of 3400 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 85 PID 4756 wrote to memory of 3400 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 85 PID 4756 wrote to memory of 2128 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 87 PID 4756 wrote to memory of 2128 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 87 PID 4756 wrote to memory of 2128 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 87 PID 4756 wrote to memory of 2556 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 88 PID 4756 wrote to memory of 2556 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 88 PID 4756 wrote to memory of 2556 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 88 PID 4756 wrote to memory of 1572 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 89 PID 4756 wrote to memory of 1572 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 89 PID 4756 wrote to memory of 1572 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 89 PID 4756 wrote to memory of 4300 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 90 PID 4756 wrote to memory of 4300 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 90 PID 4756 wrote to memory of 4300 4756 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 90 PID 3400 wrote to memory of 2696 3400 cmd.exe 95 PID 3400 wrote to memory of 2696 3400 cmd.exe 95 PID 3400 wrote to memory of 2696 3400 cmd.exe 95 PID 4300 wrote to memory of 4852 4300 cmd.exe 96 PID 4300 wrote to memory of 4852 4300 cmd.exe 96 PID 4300 wrote to memory of 4852 4300 cmd.exe 96 PID 2696 wrote to memory of 1608 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 97 PID 2696 wrote to memory of 1608 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 97 PID 2696 wrote to memory of 1608 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 97 PID 2696 wrote to memory of 5084 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 99 PID 2696 wrote to memory of 5084 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 99 PID 2696 wrote to memory of 5084 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 99 PID 2696 wrote to memory of 3776 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 100 PID 2696 wrote to memory of 3776 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 100 PID 2696 wrote to memory of 3776 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 100 PID 2696 wrote to memory of 1200 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 101 PID 2696 wrote to memory of 1200 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 101 PID 2696 wrote to memory of 1200 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 101 PID 2696 wrote to memory of 1968 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 102 PID 2696 wrote to memory of 1968 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 102 PID 2696 wrote to memory of 1968 2696 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 102 PID 1608 wrote to memory of 2580 1608 cmd.exe 107 PID 1608 wrote to memory of 2580 1608 cmd.exe 107 PID 1608 wrote to memory of 2580 1608 cmd.exe 107 PID 1968 wrote to memory of 876 1968 cmd.exe 108 PID 1968 wrote to memory of 876 1968 cmd.exe 108 PID 1968 wrote to memory of 876 1968 cmd.exe 108 PID 2580 wrote to memory of 748 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 109 PID 2580 wrote to memory of 748 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 109 PID 2580 wrote to memory of 748 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 109 PID 748 wrote to memory of 1644 748 cmd.exe 112 PID 748 wrote to memory of 1644 748 cmd.exe 112 PID 748 wrote to memory of 1644 748 cmd.exe 112 PID 2580 wrote to memory of 2704 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 113 PID 2580 wrote to memory of 2704 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 113 PID 2580 wrote to memory of 2704 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 113 PID 2580 wrote to memory of 2184 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 114 PID 2580 wrote to memory of 2184 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 114 PID 2580 wrote to memory of 2184 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 114 PID 2580 wrote to memory of 3176 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 115 PID 2580 wrote to memory of 3176 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 115 PID 2580 wrote to memory of 3176 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 115 PID 2580 wrote to memory of 4848 2580 2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\kQUcMowc\SIkkYEYo.exe"C:\Users\Admin\kQUcMowc\SIkkYEYo.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:732
-
-
C:\ProgramData\aQAYIows\VuQYEUYw.exe"C:\ProgramData\aQAYIows\VuQYEUYw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4380
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"8⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"10⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"12⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"14⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"16⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"18⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"20⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"22⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"24⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"26⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"28⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"30⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"32⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock33⤵PID:2128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"34⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock35⤵PID:1644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"36⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock37⤵PID:828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"38⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock39⤵PID:2140
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"40⤵PID:4444
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock41⤵PID:1964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"42⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock43⤵PID:220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"44⤵PID:4276
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵PID:1644
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock45⤵PID:60
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"46⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock47⤵PID:2544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"48⤵PID:2920
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock49⤵PID:412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"50⤵PID:5088
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵PID:4444
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock51⤵PID:5028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"52⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock53⤵PID:2180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"54⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock55⤵PID:908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"56⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock57⤵PID:412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"58⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock59⤵PID:4860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"60⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock61⤵PID:2728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"62⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock63⤵PID:4192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"64⤵PID:2272
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock65⤵PID:4284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"66⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock67⤵PID:1712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"68⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock69⤵PID:60
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"70⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock71⤵PID:4428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"72⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock73⤵PID:808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"74⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock75⤵PID:2756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"76⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock77⤵PID:1008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"78⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock79⤵PID:3912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"80⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock81⤵PID:1548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"82⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock83⤵PID:1672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"84⤵PID:4768
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock85⤵PID:4736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"86⤵PID:1716
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:2544
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock87⤵PID:892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"88⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock89⤵PID:4856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"90⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock91⤵PID:1992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"92⤵PID:3896
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵PID:2252
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock93⤵PID:2348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"94⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock95⤵PID:3100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"96⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock97⤵PID:2256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"98⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock99⤵PID:4252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"100⤵PID:4580
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock101⤵PID:1272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"102⤵PID:2900
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵PID:2036
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock103⤵PID:4488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"104⤵PID:2784
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵PID:4736
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock105⤵PID:3540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"106⤵PID:4840
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:4084
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock107⤵PID:1992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"108⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock109⤵PID:4688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"110⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock111⤵PID:3116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"112⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock113⤵PID:1636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"114⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock115⤵PID:1456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"116⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock117⤵PID:1764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"118⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock119⤵PID:4192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"120⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock121⤵PID:2084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-06-24_53a32a986cfc4b18a304933cb020c464_virlock"122⤵PID:656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-