Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 20:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe
-
Size
196KB
-
MD5
61cd4e9327ec5da51da328096b0fc36f
-
SHA1
253b9758f7b06743536ce8800ba7e21dd6273fce
-
SHA256
ea514385af1cd44410072e4c7aeba20d91d550b10236079dbdf126dfdd3e5de0
-
SHA512
0a38816904550129c73f1f4ea643a1b4e227d604eef42446bd1d2b9c5f38cf174cecf0d226333e7534f7b56b2cb63d307a00d25117ed6f75413b04f2a5caa5e1
-
SSDEEP
6144:GDdGBiS4E9JvqhgMHs79v+cJjbD42id2Csto5LXDRr:odGBiS4E9JvqhgC4vgpc4T9
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (64) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
Processes:
tEIckoEs.exeZiIckIgI.exepid process 4592 tEIckoEs.exe 4208 ZiIckIgI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exetEIckoEs.exeZiIckIgI.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bOQMYUwU.exe = "C:\\ProgramData\\SCUEMUEI\\bOQMYUwU.exe" 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tEIckoEs.exe = "C:\\Users\\Admin\\mKQEkIgg\\tEIckoEs.exe" 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZiIckIgI.exe = "C:\\ProgramData\\yQUEkwMo\\ZiIckIgI.exe" 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tEIckoEs.exe = "C:\\Users\\Admin\\mKQEkIgg\\tEIckoEs.exe" tEIckoEs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZiIckIgI.exe = "C:\\ProgramData\\yQUEkwMo\\ZiIckIgI.exe" ZiIckIgI.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nSYgEgUI.exe = "C:\\Users\\Admin\\byYgoYIM\\nSYgEgUI.exe" 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bOQMYUwU.exe = "C:\\ProgramData\\SCUEMUEI\\bOQMYUwU.exe" 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nSYgEgUI.exe = "C:\\Users\\Admin\\byYgoYIM\\nSYgEgUI.exe" 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4236 3504 WerFault.exe bOQMYUwU.exe 1736 1764 WerFault.exe nSYgEgUI.exe 3556 3192 WerFault.exe nSYgEgUI.exe 4604 4988 WerFault.exe bOQMYUwU.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1236 reg.exe 2660 reg.exe 3940 reg.exe 2140 reg.exe 1884 reg.exe 1360 reg.exe 4332 reg.exe 2160 reg.exe 5048 reg.exe 3092 reg.exe 2092 reg.exe 2912 reg.exe 2396 reg.exe 4532 reg.exe 4248 reg.exe 3480 reg.exe 3068 reg.exe 4384 reg.exe 3896 reg.exe 1632 reg.exe 1580 reg.exe 3840 reg.exe 4248 reg.exe 4416 reg.exe 1984 reg.exe 3196 reg.exe 3172 reg.exe 4480 reg.exe 2164 reg.exe 4236 reg.exe 1696 reg.exe 3052 reg.exe 4424 reg.exe 2840 reg.exe 2780 reg.exe 2396 reg.exe 1172 reg.exe 672 reg.exe 2904 reg.exe 668 reg.exe 2948 reg.exe 3336 reg.exe 3964 reg.exe 1180 reg.exe 4476 reg.exe 2796 reg.exe 744 reg.exe 4416 reg.exe 1816 reg.exe 2152 reg.exe 528 reg.exe 1444 reg.exe 2040 reg.exe 1908 reg.exe 440 reg.exe 3380 reg.exe 1744 reg.exe 4552 reg.exe 4212 reg.exe 1360 reg.exe 3680 reg.exe 2216 reg.exe 3096 reg.exe 3964 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exepid process 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2324 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2324 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2324 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2324 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3068 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3068 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3068 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3068 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3252 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3252 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3252 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3252 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3232 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3232 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3232 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3232 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2656 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2656 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2656 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 2656 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 1188 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 1188 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 1188 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 1188 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3256 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3256 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3256 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3256 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3112 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3112 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3112 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3112 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4684 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4684 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4684 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4684 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3692 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3692 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3692 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3692 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3644 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3644 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3644 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 3644 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4328 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4328 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4328 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4328 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4900 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4900 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4900 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe 4900 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.execmd.execmd.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.execmd.execmd.exe2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.execmd.exedescription pid process target process PID 3364 wrote to memory of 4592 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe tEIckoEs.exe PID 3364 wrote to memory of 4592 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe tEIckoEs.exe PID 3364 wrote to memory of 4592 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe tEIckoEs.exe PID 3364 wrote to memory of 4208 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe ZiIckIgI.exe PID 3364 wrote to memory of 4208 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe ZiIckIgI.exe PID 3364 wrote to memory of 4208 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe ZiIckIgI.exe PID 3364 wrote to memory of 4852 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 3364 wrote to memory of 4852 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 3364 wrote to memory of 4852 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 4852 wrote to memory of 2268 4852 cmd.exe 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe PID 4852 wrote to memory of 2268 4852 cmd.exe 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe PID 4852 wrote to memory of 2268 4852 cmd.exe 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe PID 3364 wrote to memory of 3100 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 3364 wrote to memory of 3100 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 3364 wrote to memory of 3100 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 3364 wrote to memory of 4384 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 3364 wrote to memory of 4384 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 3364 wrote to memory of 4384 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 3364 wrote to memory of 3368 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 3364 wrote to memory of 3368 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 3364 wrote to memory of 3368 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 3364 wrote to memory of 4956 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 3364 wrote to memory of 4956 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 3364 wrote to memory of 4956 3364 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 4956 wrote to memory of 3352 4956 cmd.exe cscript.exe PID 4956 wrote to memory of 3352 4956 cmd.exe cscript.exe PID 4956 wrote to memory of 3352 4956 cmd.exe cscript.exe PID 2268 wrote to memory of 2836 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 2268 wrote to memory of 2836 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 2268 wrote to memory of 2836 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 2836 wrote to memory of 2148 2836 cmd.exe 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe PID 2836 wrote to memory of 2148 2836 cmd.exe 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe PID 2836 wrote to memory of 2148 2836 cmd.exe 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe PID 2268 wrote to memory of 4988 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2268 wrote to memory of 4988 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2268 wrote to memory of 4988 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2268 wrote to memory of 4532 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2268 wrote to memory of 4532 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2268 wrote to memory of 4532 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2268 wrote to memory of 4992 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2268 wrote to memory of 4992 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2268 wrote to memory of 4992 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2268 wrote to memory of 3376 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 2268 wrote to memory of 3376 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 2268 wrote to memory of 3376 2268 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 3376 wrote to memory of 4248 3376 cmd.exe cscript.exe PID 3376 wrote to memory of 4248 3376 cmd.exe cscript.exe PID 3376 wrote to memory of 4248 3376 cmd.exe cscript.exe PID 2148 wrote to memory of 1516 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 2148 wrote to memory of 1516 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 2148 wrote to memory of 1516 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe PID 1516 wrote to memory of 2324 1516 cmd.exe 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe PID 1516 wrote to memory of 2324 1516 cmd.exe 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe PID 1516 wrote to memory of 2324 1516 cmd.exe 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe PID 2148 wrote to memory of 440 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2148 wrote to memory of 440 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2148 wrote to memory of 440 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2148 wrote to memory of 2308 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2148 wrote to memory of 2308 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2148 wrote to memory of 2308 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2148 wrote to memory of 2316 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2148 wrote to memory of 2316 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2148 wrote to memory of 2316 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe reg.exe PID 2148 wrote to memory of 2704 2148 2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\mKQEkIgg\tEIckoEs.exe"C:\Users\Admin\mKQEkIgg\tEIckoEs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4592 -
C:\ProgramData\yQUEkwMo\ZiIckIgI.exe"C:\ProgramData\yQUEkwMo\ZiIckIgI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"8⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"10⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"12⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"14⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"16⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock17⤵
- Adds Run key to start application
PID:5020 -
C:\Users\Admin\byYgoYIM\nSYgEgUI.exe"C:\Users\Admin\byYgoYIM\nSYgEgUI.exe"18⤵PID:1764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 22419⤵
- Program crash
PID:1736 -
C:\ProgramData\SCUEMUEI\bOQMYUwU.exe"C:\ProgramData\SCUEMUEI\bOQMYUwU.exe"18⤵PID:3504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 22419⤵
- Program crash
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"18⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"20⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"22⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"24⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"26⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"28⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"30⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"32⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"34⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock35⤵PID:3360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"36⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock37⤵PID:2160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"38⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock39⤵PID:1696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"40⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock41⤵PID:4524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"42⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock43⤵PID:3372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"44⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock45⤵PID:1236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"46⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock47⤵PID:2884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"48⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock49⤵PID:1688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"50⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock51⤵PID:4548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"52⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock53⤵PID:2904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"54⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock55⤵PID:2668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"56⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock57⤵PID:3592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"58⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock59⤵PID:3556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"60⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock61⤵PID:4476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"62⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock63⤵PID:1424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"64⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock65⤵PID:3112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"66⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock67⤵PID:3480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"68⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock69⤵PID:4796
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"70⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock71⤵PID:2368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"72⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock73⤵PID:2476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"74⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock75⤵PID:3176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"76⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock77⤵PID:3376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"78⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock79⤵PID:3152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"80⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock81⤵PID:2920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"82⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock83⤵PID:2724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"84⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock85⤵PID:228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"86⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock87⤵PID:3180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"88⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock89⤵PID:2816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"90⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock91⤵PID:4532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"92⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock93⤵PID:5064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"94⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock95⤵PID:2140
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"96⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock97⤵PID:1040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"98⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock99⤵PID:2924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"100⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock101⤵PID:1624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"102⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock103⤵PID:3188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"104⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock105⤵PID:2184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"106⤵PID:3904
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock107⤵PID:2796
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"108⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock109⤵PID:4956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"110⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock111⤵PID:4532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"112⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock113⤵PID:4472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"114⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock115⤵PID:2704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"116⤵PID:2840
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock117⤵PID:3092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"118⤵PID:220
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock119⤵PID:2516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"120⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock121⤵PID:1312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"122⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock123⤵PID:2704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"124⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock125⤵PID:3692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"126⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock127⤵PID:860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"128⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock129⤵
- Adds Run key to start application
PID:5020 -
C:\Users\Admin\byYgoYIM\nSYgEgUI.exe"C:\Users\Admin\byYgoYIM\nSYgEgUI.exe"130⤵PID:3192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 184131⤵
- Program crash
PID:3556 -
C:\ProgramData\SCUEMUEI\bOQMYUwU.exe"C:\ProgramData\SCUEMUEI\bOQMYUwU.exe"130⤵PID:4988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 188131⤵
- Program crash
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"130⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock131⤵PID:1128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"132⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock133⤵PID:4916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"134⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock135⤵PID:2884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"136⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock137⤵PID:3920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"138⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock139⤵PID:3068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"140⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock141⤵PID:3764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"142⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock143⤵PID:2476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"144⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock145⤵PID:2360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"146⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock147⤵PID:4384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"148⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock149⤵PID:3812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"150⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock151⤵PID:3352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"152⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock153⤵PID:516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"154⤵PID:1148
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock155⤵PID:1736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"156⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock157⤵PID:4988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"158⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock159⤵PID:4384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"160⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock161⤵PID:3340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"162⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock163⤵PID:3764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"164⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock165⤵PID:3940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"166⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock167⤵PID:4612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"168⤵PID:1364
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock169⤵PID:4532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"170⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock171⤵PID:3552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"172⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock173⤵PID:1844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"174⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock175⤵PID:3196
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"176⤵PID:3308
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1177⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock177⤵PID:4532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"178⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock179⤵PID:528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"180⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock181⤵PID:2464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"182⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock183⤵PID:4424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"184⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock185⤵PID:3360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"186⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock187⤵PID:1632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"188⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock189⤵PID:3340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"190⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock191⤵PID:2360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"192⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock193⤵PID:4552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"194⤵PID:5112
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock195⤵PID:2172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"196⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock197⤵PID:4912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"198⤵PID:760
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1199⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock199⤵PID:4056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"200⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock201⤵PID:3052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"202⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock203⤵PID:4648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"204⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock205⤵PID:3216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"206⤵PID:4596
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock207⤵PID:3552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"208⤵PID:3352
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock209⤵PID:3200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"210⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock211⤵PID:3308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"212⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock213⤵PID:3616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"214⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock215⤵PID:3068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"216⤵PID:2856
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1217⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock217⤵PID:3688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"218⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock219⤵PID:1844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"220⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock221⤵PID:4040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"222⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock223⤵PID:2420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"224⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock225⤵PID:4960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"226⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock227⤵PID:4664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"228⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock229⤵PID:1984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"230⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock231⤵PID:3904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"232⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock233⤵PID:880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"234⤵PID:3496
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock235⤵PID:756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"236⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock237⤵PID:3792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"238⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock239⤵PID:4600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock"240⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_61cd4e9327ec5da51da328096b0fc36f_virlock241⤵PID:1360
-