Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 19:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe
-
Size
204KB
-
MD5
25d6586cf3cea9c9a3b7c8d4b784edbc
-
SHA1
7e2340a2426c74af6c0639907c151ba9b24676b1
-
SHA256
0f3b66fece3bd62664a4ae3f5996bfa41ef910e75f65a8725903267f4ef85a0e
-
SHA512
373b15720a3769f6e1418f51fdc7b24f0b719b5a15a17d4e1e3a9a7fe2f02e1bc2efa7f6575ee2449dc6a5633d1b9b3518bea8869591224f3827403954eeb486
-
SSDEEP
6144:Uq/GqGiKuik1aB+o4nRo0Rc6rNW+ZM7Rn:U4Gqdj19csS
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 4 IoCs
Processes:
flow pid process 39 1400 43 1400 45 1400 46 1400 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
KwswEscs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation KwswEscs.exe -
Executes dropped EXE 2 IoCs
Processes:
YmYUYUUU.exeKwswEscs.exepid process 2052 YmYUYUUU.exe 692 KwswEscs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeKwswEscs.exeYmYUYUUU.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KwswEscs.exe = "C:\\ProgramData\\EUEcYkQg\\KwswEscs.exe" 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KwswEscs.exe = "C:\\ProgramData\\EUEcYkQg\\KwswEscs.exe" KwswEscs.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YmYUYUUU.exe = "C:\\Users\\Admin\\xkcIcgIk\\YmYUYUUU.exe" YmYUYUUU.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SOUwgEog.exe = "C:\\Users\\Admin\\UEEUcock\\SOUwgEog.exe" 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oIIoEIco.exe = "C:\\ProgramData\\BkcUEIYY\\oIIoEIco.exe" 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YmYUYUUU.exe = "C:\\Users\\Admin\\xkcIcgIk\\YmYUYUUU.exe" 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe -
Drops file in System32 directory 2 IoCs
Processes:
KwswEscs.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe KwswEscs.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe KwswEscs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3364 2648 WerFault.exe SOUwgEog.exe 3368 4852 WerFault.exe oIIoEIco.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4936 1468 reg.exe 3524 reg.exe 2096 reg.exe 2828 reg.exe 2412 reg.exe 860 reg.exe 868 4528 reg.exe 4520 reg.exe 3516 reg.exe 3664 reg.exe 3016 reg.exe 2728 2412 reg.exe 2796 reg.exe 2444 3936 4764 reg.exe 4896 reg.exe 3468 2696 1080 1636 reg.exe 4264 reg.exe 1624 3296 4648 reg.exe 1796 reg.exe 2564 reg.exe 2264 reg.exe 2844 reg.exe 1260 3864 reg.exe 1232 reg.exe 232 1692 2184 2004 2584 reg.exe 928 reg.exe 3104 reg.exe 2968 reg.exe 4676 reg.exe 1796 reg.exe 3712 reg.exe 3288 reg.exe 5096 reg.exe 3868 reg.exe 3532 reg.exe 4472 reg.exe 2612 reg.exe 4244 reg.exe 2960 reg.exe 4764 reg.exe 1648 reg.exe 3324 reg.exe 4952 reg.exe 4148 reg.exe 2028 reg.exe 2908 reg.exe 2832 reg.exe 2376 reg.exe 2688 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exepid process 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2780 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2780 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2780 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2780 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4676 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4676 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4676 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4676 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2396 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2396 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2396 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2396 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4992 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4992 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4992 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4992 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2000 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2000 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2000 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2000 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3912 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3912 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3912 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3912 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3332 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3332 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3332 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3332 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2776 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2776 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2776 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2776 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4720 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4720 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4720 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 4720 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1976 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1976 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1976 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1976 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2232 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2232 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2232 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 2232 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1628 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1628 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1628 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 1628 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3524 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3524 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3524 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe 3524 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
KwswEscs.exepid process 692 KwswEscs.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
KwswEscs.exepid process 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe 692 KwswEscs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.execmd.execmd.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.execmd.execmd.exe2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.execmd.exedescription pid process target process PID 3452 wrote to memory of 2052 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe YmYUYUUU.exe PID 3452 wrote to memory of 2052 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe YmYUYUUU.exe PID 3452 wrote to memory of 2052 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe YmYUYUUU.exe PID 3452 wrote to memory of 692 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe KwswEscs.exe PID 3452 wrote to memory of 692 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe KwswEscs.exe PID 3452 wrote to memory of 692 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe KwswEscs.exe PID 3452 wrote to memory of 1164 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 3452 wrote to memory of 1164 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 3452 wrote to memory of 1164 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 1164 wrote to memory of 3180 1164 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 1164 wrote to memory of 3180 1164 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 1164 wrote to memory of 3180 1164 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 3452 wrote to memory of 1236 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3452 wrote to memory of 1236 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3452 wrote to memory of 1236 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3452 wrote to memory of 4940 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3452 wrote to memory of 4940 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3452 wrote to memory of 4940 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3452 wrote to memory of 2996 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3452 wrote to memory of 2996 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3452 wrote to memory of 2996 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3452 wrote to memory of 2000 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 3452 wrote to memory of 2000 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 3452 wrote to memory of 2000 3452 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 2000 wrote to memory of 1228 2000 cmd.exe cscript.exe PID 2000 wrote to memory of 1228 2000 cmd.exe cscript.exe PID 2000 wrote to memory of 1228 2000 cmd.exe cscript.exe PID 3180 wrote to memory of 4780 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 3180 wrote to memory of 4780 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 3180 wrote to memory of 4780 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 4780 wrote to memory of 3876 4780 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 4780 wrote to memory of 3876 4780 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 4780 wrote to memory of 3876 4780 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 3180 wrote to memory of 2584 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3180 wrote to memory of 2584 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3180 wrote to memory of 2584 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3180 wrote to memory of 1400 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3180 wrote to memory of 1400 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3180 wrote to memory of 1400 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3180 wrote to memory of 2980 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3180 wrote to memory of 2980 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3180 wrote to memory of 2980 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3180 wrote to memory of 1552 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 3180 wrote to memory of 1552 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 3180 wrote to memory of 1552 3180 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 1552 wrote to memory of 5040 1552 cmd.exe cscript.exe PID 1552 wrote to memory of 5040 1552 cmd.exe cscript.exe PID 1552 wrote to memory of 5040 1552 cmd.exe cscript.exe PID 3876 wrote to memory of 216 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 3876 wrote to memory of 216 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 3876 wrote to memory of 216 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe PID 216 wrote to memory of 2780 216 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 216 wrote to memory of 2780 216 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 216 wrote to memory of 2780 216 cmd.exe 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe PID 3876 wrote to memory of 1976 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3876 wrote to memory of 1976 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3876 wrote to memory of 1976 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3876 wrote to memory of 2988 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3876 wrote to memory of 2988 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3876 wrote to memory of 2988 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3876 wrote to memory of 1488 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3876 wrote to memory of 1488 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3876 wrote to memory of 1488 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe reg.exe PID 3876 wrote to memory of 928 3876 2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\xkcIcgIk\YmYUYUUU.exe"C:\Users\Admin\xkcIcgIk\YmYUYUUU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\EUEcYkQg\KwswEscs.exe"C:\ProgramData\EUEcYkQg\KwswEscs.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"54⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"56⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"62⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"82⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"104⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"106⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"110⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"124⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"126⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"128⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"136⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1137⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"142⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1143⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"152⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"154⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"160⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"166⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1167⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"168⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"170⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"176⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1177⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"178⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock187⤵
- Adds Run key to start application
-
C:\Users\Admin\UEEUcock\SOUwgEog.exe"C:\Users\Admin\UEEUcock\SOUwgEog.exe"188⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 224189⤵
- Program crash
-
C:\ProgramData\BkcUEIYY\oIIoEIco.exe"C:\ProgramData\BkcUEIYY\oIIoEIco.exe"188⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 224189⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"188⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1189⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"192⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1193⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"202⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"208⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"214⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1215⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"218⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"226⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1227⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"230⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"232⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1233⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"234⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"238⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1239⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-23_25d6586cf3cea9c9a3b7c8d4b784edbc_virlock241⤵