Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe
-
Size
207KB
-
MD5
17b82e64e80caab520aac1965ba4f8cb
-
SHA1
2e4a23c270b3e8d9324a7192f07f405ef03bea59
-
SHA256
a376ad480944f8a6e3dd1fe3a260a9d6196b88010a91e1af0883d2f44bc29784
-
SHA512
e882a59ea0feaa556a303e7857f04f1415216509658ed5888c2e61b4de5f136e4cfe4f09e8e54ecee42abadec53431520aa3646401df400e87f2cace67eab3a7
-
SSDEEP
3072:+xeV4f7Gdz24bTZ6OoaqGGY6wzOKbghx0O8CLLpK6LC0Pybl:KeVwQiq9epwR0b5K67P4l
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (86) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dwUkkgww.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation dwUkkgww.exe -
Executes dropped EXE 2 IoCs
Processes:
dwUkkgww.exePYYwggQQ.exepid process 4896 dwUkkgww.exe 3312 PYYwggQQ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
PYYwggQQ.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exedwUkkgww.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PYYwggQQ.exe = "C:\\ProgramData\\OYMUcssE\\PYYwggQQ.exe" PYYwggQQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LUMkMUYg.exe = "C:\\Users\\Admin\\WoYUoowM\\LUMkMUYg.exe" 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scAwcIQQ.exe = "C:\\ProgramData\\AgoQkwgg\\scAwcIQQ.exe" 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwUkkgww.exe = "C:\\Users\\Admin\\HGYoAkYk\\dwUkkgww.exe" 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PYYwggQQ.exe = "C:\\ProgramData\\OYMUcssE\\PYYwggQQ.exe" 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwUkkgww.exe = "C:\\Users\\Admin\\HGYoAkYk\\dwUkkgww.exe" dwUkkgww.exe -
Drops file in System32 directory 2 IoCs
Processes:
dwUkkgww.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe dwUkkgww.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe dwUkkgww.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3476 436 WerFault.exe scAwcIQQ.exe 4904 3640 WerFault.exe LUMkMUYg.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 908 reg.exe 2504 reg.exe 4172 reg.exe 3864 reg.exe 3480 reg.exe 3616 reg.exe 316 reg.exe 3092 reg.exe 5060 reg.exe 4224 reg.exe 1972 3944 reg.exe 544 reg.exe 552 reg.exe 4344 reg.exe 1924 reg.exe 3824 reg.exe 1212 reg.exe 1064 reg.exe 5012 reg.exe 3920 reg.exe 1268 reg.exe 1268 4276 reg.exe 1988 reg.exe 4232 reg.exe 4536 reg.exe 1296 reg.exe 552 reg.exe 3488 reg.exe 3784 reg.exe 908 reg.exe 3936 reg.exe 4884 reg.exe 3768 reg.exe 2672 reg.exe 1304 reg.exe 1432 2720 reg.exe 4240 reg.exe 4908 reg.exe 528 reg.exe 1328 reg.exe 4764 reg.exe 4552 reg.exe 4280 reg.exe 3756 reg.exe 4572 reg.exe 2220 reg.exe 4500 reg.exe 2104 reg.exe 2680 reg.exe 1256 reg.exe 3496 reg.exe 4700 reg.exe 3552 reg.exe 3464 reg.exe 3604 reg.exe 1604 reg.exe 4952 reg.exe 1408 reg.exe 552 reg.exe 1020 reg.exe 1576 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exepid process 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2648 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2648 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2648 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2648 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 652 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 652 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 652 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 652 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 708 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 708 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 708 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 708 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 396 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 396 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 396 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 396 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4920 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4920 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4920 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4920 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 756 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 756 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 756 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 756 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4524 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4524 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4524 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4524 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4664 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4664 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4664 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4664 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4588 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4588 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4588 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4588 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3976 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3976 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3976 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 3976 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4412 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4412 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4412 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 4412 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2960 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2960 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2960 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 2960 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1340 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1340 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1340 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe 1340 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwUkkgww.exepid process 4896 dwUkkgww.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
dwUkkgww.exepid process 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe 4896 dwUkkgww.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.execmd.execmd.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.execmd.execmd.exe2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.execmd.exedescription pid process target process PID 2080 wrote to memory of 4896 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe dwUkkgww.exe PID 2080 wrote to memory of 4896 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe dwUkkgww.exe PID 2080 wrote to memory of 4896 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe dwUkkgww.exe PID 2080 wrote to memory of 3312 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PYYwggQQ.exe PID 2080 wrote to memory of 3312 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PYYwggQQ.exe PID 2080 wrote to memory of 3312 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PYYwggQQ.exe PID 2080 wrote to memory of 1408 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2080 wrote to memory of 1408 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2080 wrote to memory of 1408 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 1408 wrote to memory of 1012 1408 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 1408 wrote to memory of 1012 1408 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 1408 wrote to memory of 1012 1408 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 2080 wrote to memory of 3952 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2080 wrote to memory of 3952 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2080 wrote to memory of 3952 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2080 wrote to memory of 220 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2080 wrote to memory of 220 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2080 wrote to memory of 220 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2080 wrote to memory of 208 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2080 wrote to memory of 208 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2080 wrote to memory of 208 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 2080 wrote to memory of 4036 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2080 wrote to memory of 4036 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2080 wrote to memory of 4036 2080 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 4036 wrote to memory of 396 4036 cmd.exe cscript.exe PID 4036 wrote to memory of 396 4036 cmd.exe cscript.exe PID 4036 wrote to memory of 396 4036 cmd.exe cscript.exe PID 1012 wrote to memory of 680 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 1012 wrote to memory of 680 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 1012 wrote to memory of 680 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 680 wrote to memory of 3904 680 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 680 wrote to memory of 3904 680 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 680 wrote to memory of 3904 680 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 1012 wrote to memory of 1328 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 1012 wrote to memory of 1328 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 1012 wrote to memory of 1328 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 1012 wrote to memory of 5040 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 1012 wrote to memory of 5040 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 1012 wrote to memory of 5040 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 1012 wrote to memory of 1884 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 1012 wrote to memory of 1884 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 1012 wrote to memory of 1884 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 1012 wrote to memory of 2312 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 1012 wrote to memory of 2312 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 1012 wrote to memory of 2312 1012 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 2312 wrote to memory of 1360 2312 cmd.exe cscript.exe PID 2312 wrote to memory of 1360 2312 cmd.exe cscript.exe PID 2312 wrote to memory of 1360 2312 cmd.exe cscript.exe PID 3904 wrote to memory of 4280 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 3904 wrote to memory of 4280 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 3904 wrote to memory of 4280 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe PID 4280 wrote to memory of 2648 4280 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 4280 wrote to memory of 2648 4280 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 4280 wrote to memory of 2648 4280 cmd.exe 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe PID 3904 wrote to memory of 1264 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 3904 wrote to memory of 1264 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 3904 wrote to memory of 1264 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 3904 wrote to memory of 4344 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 3904 wrote to memory of 4344 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 3904 wrote to memory of 4344 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 3904 wrote to memory of 1020 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 3904 wrote to memory of 1020 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 3904 wrote to memory of 1020 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe reg.exe PID 3904 wrote to memory of 4144 3904 2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\HGYoAkYk\dwUkkgww.exe"C:\Users\Admin\HGYoAkYk\dwUkkgww.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\OYMUcssE\PYYwggQQ.exe"C:\ProgramData\OYMUcssE\PYYwggQQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"74⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"76⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"108⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"110⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"114⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"122⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"124⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1125⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"126⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1127⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"128⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock129⤵
- Adds Run key to start application
-
C:\Users\Admin\WoYUoowM\LUMkMUYg.exe"C:\Users\Admin\WoYUoowM\LUMkMUYg.exe"130⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 224131⤵
- Program crash
-
C:\ProgramData\AgoQkwgg\scAwcIQQ.exe"C:\ProgramData\AgoQkwgg\scAwcIQQ.exe"130⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 224131⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"132⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"134⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1135⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"142⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"146⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"150⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"154⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"160⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"164⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"166⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"168⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"176⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"178⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"180⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"190⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1191⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"192⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"194⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"198⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"202⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"204⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"206⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"208⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1209⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"214⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"216⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"218⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"230⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"234⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-24_17b82e64e80caab520aac1965ba4f8cb_virlock241⤵