Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 10:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe
-
Size
196KB
-
MD5
a94521cdb67266001bc7cb26a9f69a5f
-
SHA1
1f43d1ed84c8364a636f247191b90e210d50e55c
-
SHA256
93458ccffbf93e914273f07f982a2b35ca52c29eab962cdb4e4074fd9fee96c4
-
SHA512
ac0fb81f63e232d7d3c41a681f912d385ea368aa20023639f284777525a9c0e711b62c92ad3b735756a63337ac7a633b1488954e00fd46dc85a8d2232040edf8
-
SSDEEP
3072:RgiWNBtVui51S9sY3N6TmuxHlVaDbR08xft9/j6HTUvhRcK7:SNBtVuibS9syMxFVC08Zr6YD
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WisIoAgI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation WisIoAgI.exe -
Executes dropped EXE 2 IoCs
Processes:
WisIoAgI.exeJAswkEEw.exepid process 2432 WisIoAgI.exe 4832 JAswkEEw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeWisIoAgI.exeJAswkEEw.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WisIoAgI.exe = "C:\\Users\\Admin\\sQoYcgMo\\WisIoAgI.exe" 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JAswkEEw.exe = "C:\\ProgramData\\rQwsQgcQ\\JAswkEEw.exe" 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WisIoAgI.exe = "C:\\Users\\Admin\\sQoYcgMo\\WisIoAgI.exe" WisIoAgI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JAswkEEw.exe = "C:\\ProgramData\\rQwsQgcQ\\JAswkEEw.exe" JAswkEEw.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LyccUEcA.exe = "C:\\Users\\Admin\\XIoYUAYw\\LyccUEcA.exe" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TiowUsEQ.exe = "C:\\ProgramData\\Lisskcoc\\TiowUsEQ.exe" -
Drops file in System32 directory 1 IoCs
Processes:
WisIoAgI.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe WisIoAgI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
pid pid_target process target process 4584 2040 1404 3540 -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1508 1980 376 reg.exe 4344 reg.exe 2924 reg.exe 1172 reg.exe 3964 reg.exe 3688 reg.exe 4592 reg.exe 2776 reg.exe 4556 reg.exe 3584 reg.exe 4344 reg.exe 3032 3760 reg.exe 3840 reg.exe 4236 reg.exe 2712 reg.exe 3396 reg.exe 3112 reg.exe 4904 reg.exe 4116 reg.exe 876 reg.exe 2096 reg.exe 2732 reg.exe 2900 reg.exe 4464 reg.exe 1572 reg.exe 3400 1800 reg.exe 436 reg.exe 4060 reg.exe 1004 reg.exe 5088 reg.exe 4808 reg.exe 712 reg.exe 4664 2728 1160 reg.exe 1336 reg.exe 4808 reg.exe 1844 reg.exe 5020 reg.exe 3616 reg.exe 820 reg.exe 4036 4560 4260 reg.exe 4896 reg.exe 3584 reg.exe 2032 reg.exe 5004 reg.exe 3360 reg.exe 2892 4540 4476 reg.exe 4036 reg.exe 5032 reg.exe 5108 reg.exe 2492 reg.exe 4016 2724 reg.exe 3580 reg.exe 1528 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exepid process 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1172 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1172 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1172 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1172 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4868 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4868 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4868 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4868 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 3808 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 3808 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 3808 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 3808 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4792 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4792 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4792 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4792 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 3616 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 3616 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 3616 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 3616 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4480 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4480 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4480 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4480 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4468 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4468 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4468 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4468 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1476 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1476 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1476 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1476 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 916 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 916 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 916 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 916 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 380 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 380 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 380 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 380 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4300 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4300 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4300 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 4300 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1480 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1480 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1480 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 1480 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 2588 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 2588 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 2588 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe 2588 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WisIoAgI.exepid process 2432 WisIoAgI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
WisIoAgI.exepid process 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe 2432 WisIoAgI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.execmd.execmd.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.execmd.execmd.exe2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.execmd.exedescription pid process target process PID 3084 wrote to memory of 2432 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe WisIoAgI.exe PID 3084 wrote to memory of 2432 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe WisIoAgI.exe PID 3084 wrote to memory of 2432 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe WisIoAgI.exe PID 3084 wrote to memory of 4832 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe JAswkEEw.exe PID 3084 wrote to memory of 4832 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe JAswkEEw.exe PID 3084 wrote to memory of 4832 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe JAswkEEw.exe PID 3084 wrote to memory of 3416 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 3084 wrote to memory of 3416 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 3084 wrote to memory of 3416 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 3416 wrote to memory of 948 3416 cmd.exe 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe PID 3416 wrote to memory of 948 3416 cmd.exe 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe PID 3416 wrote to memory of 948 3416 cmd.exe 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe PID 3084 wrote to memory of 2636 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 3084 wrote to memory of 2636 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 3084 wrote to memory of 2636 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 3084 wrote to memory of 3688 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 3084 wrote to memory of 3688 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 3084 wrote to memory of 3688 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 3084 wrote to memory of 3284 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 3084 wrote to memory of 3284 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 3084 wrote to memory of 3284 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 3084 wrote to memory of 532 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 3084 wrote to memory of 532 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 3084 wrote to memory of 532 3084 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 532 wrote to memory of 4996 532 cmd.exe cscript.exe PID 532 wrote to memory of 4996 532 cmd.exe cscript.exe PID 532 wrote to memory of 4996 532 cmd.exe cscript.exe PID 948 wrote to memory of 3032 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 948 wrote to memory of 3032 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 948 wrote to memory of 3032 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 3032 wrote to memory of 2900 3032 cmd.exe 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe PID 3032 wrote to memory of 2900 3032 cmd.exe 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe PID 3032 wrote to memory of 2900 3032 cmd.exe 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe PID 948 wrote to memory of 4640 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 948 wrote to memory of 4640 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 948 wrote to memory of 4640 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 948 wrote to memory of 3836 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 948 wrote to memory of 3836 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 948 wrote to memory of 3836 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 948 wrote to memory of 2028 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 948 wrote to memory of 2028 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 948 wrote to memory of 2028 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 948 wrote to memory of 3320 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 948 wrote to memory of 3320 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 948 wrote to memory of 3320 948 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 3320 wrote to memory of 2376 3320 cmd.exe cscript.exe PID 3320 wrote to memory of 2376 3320 cmd.exe cscript.exe PID 3320 wrote to memory of 2376 3320 cmd.exe cscript.exe PID 2900 wrote to memory of 636 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 2900 wrote to memory of 636 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 2900 wrote to memory of 636 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe PID 636 wrote to memory of 1172 636 cmd.exe 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe PID 636 wrote to memory of 1172 636 cmd.exe 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe PID 636 wrote to memory of 1172 636 cmd.exe 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe PID 2900 wrote to memory of 428 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 2900 wrote to memory of 428 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 2900 wrote to memory of 428 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 2900 wrote to memory of 3396 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 2900 wrote to memory of 3396 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 2900 wrote to memory of 3396 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 2900 wrote to memory of 1616 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 2900 wrote to memory of 1616 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 2900 wrote to memory of 1616 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe reg.exe PID 2900 wrote to memory of 4368 2900 2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\sQoYcgMo\WisIoAgI.exe"C:\Users\Admin\sQoYcgMo\WisIoAgI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\rQwsQgcQ\JAswkEEw.exe"C:\ProgramData\rQwsQgcQ\JAswkEEw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"58⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"66⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"78⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"104⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"196⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1197⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"198⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1199⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"202⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"206⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"208⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_a94521cdb67266001bc7cb26a9f69a5f_virlock"240⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1241⤵