Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 00:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe
-
Size
194KB
-
MD5
133a8c1a28986426d2eb0ba6daf4756e
-
SHA1
954d8ec4bca96c898e8c6dd46b153d314066d656
-
SHA256
bf12b8d4b73b9a620d6f6fae322ea8763b26932b6802586f610a7a41e3787537
-
SHA512
4e049d4f65f5a63a3c85d5f7bc2978c66d88acac3cdb75905463afc0da0bea5ac4cc307aa0aeb1e02b0c7f8af8cafbabdf6040236a230dea49455f08711fa6ac
-
SSDEEP
3072:yF9pLvxydiOrQslB/waKwThbs6XxmBv0CnMOKyFW3ArtsL2U2XckMA/:y/tZyd0S/wpWs6hmqp6pw25l
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (81) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
koYEAMgA.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation koYEAMgA.exe -
Executes dropped EXE 2 IoCs
Processes:
koYEAMgA.exeqUUggUAs.exepid process 1404 koYEAMgA.exe 1880 qUUggUAs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exekoYEAMgA.exeqUUggUAs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koYEAMgA.exe = "C:\\Users\\Admin\\NyowAkUY\\koYEAMgA.exe" 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qUUggUAs.exe = "C:\\ProgramData\\ZKgAsgUI\\qUUggUAs.exe" 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koYEAMgA.exe = "C:\\Users\\Admin\\NyowAkUY\\koYEAMgA.exe" koYEAMgA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qUUggUAs.exe = "C:\\ProgramData\\ZKgAsgUI\\qUUggUAs.exe" qUUggUAs.exe -
Drops file in System32 directory 2 IoCs
Processes:
koYEAMgA.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe koYEAMgA.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe koYEAMgA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 3196 3224 reg.exe 4164 reg.exe 3520 reg.exe 3944 reg.exe 2212 reg.exe 2876 reg.exe 4076 reg.exe 3704 reg.exe 992 reg.exe 2828 reg.exe 2664 reg.exe 2548 reg.exe 4844 reg.exe 1816 reg.exe 2744 reg.exe 3344 reg.exe 5072 reg.exe 1160 reg.exe 1992 reg.exe 928 reg.exe 1612 reg.exe 1656 reg.exe 5104 reg.exe 4920 reg.exe 4288 reg.exe 220 reg.exe 2248 reg.exe 1008 2452 reg.exe 5096 reg.exe 1992 reg.exe 944 reg.exe 3132 reg.exe 4576 reg.exe 1360 reg.exe 2744 reg.exe 1688 reg.exe 2820 reg.exe 4164 reg.exe 1360 reg.exe 3956 reg.exe 3184 reg.exe 4960 reg.exe 3824 reg.exe 1268 reg.exe 4540 reg.exe 2248 reg.exe 2472 reg.exe 1936 reg.exe 2524 reg.exe 1388 reg.exe 2664 reg.exe 2916 reg.exe 3980 reg.exe 2844 reg.exe 2004 reg.exe 3112 4220 reg.exe 1236 reg.exe 2944 reg.exe 2932 reg.exe 1856 reg.exe 884 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exepid process 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 3764 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 3764 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 3764 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 3764 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4672 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4672 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4672 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4672 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 1920 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 1920 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 1920 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 1920 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 5068 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 5068 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 5068 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 5068 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 3180 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 3180 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 3180 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 3180 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4376 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4376 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4376 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4376 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2212 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2212 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2212 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2212 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4940 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4940 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4940 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4940 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 816 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 816 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 816 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 816 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 436 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 436 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 436 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 436 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2944 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2944 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2944 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 2944 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4200 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4200 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4200 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe 4200 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
koYEAMgA.exepid process 1404 koYEAMgA.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
koYEAMgA.exepid process 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe 1404 koYEAMgA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.execmd.execmd.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.execmd.execmd.exe2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.execmd.exedescription pid process target process PID 4820 wrote to memory of 1404 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe koYEAMgA.exe PID 4820 wrote to memory of 1404 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe koYEAMgA.exe PID 4820 wrote to memory of 1404 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe koYEAMgA.exe PID 4820 wrote to memory of 1880 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe qUUggUAs.exe PID 4820 wrote to memory of 1880 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe qUUggUAs.exe PID 4820 wrote to memory of 1880 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe qUUggUAs.exe PID 4820 wrote to memory of 2444 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 4820 wrote to memory of 2444 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 4820 wrote to memory of 2444 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 2444 wrote to memory of 1488 2444 cmd.exe 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe PID 2444 wrote to memory of 1488 2444 cmd.exe 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe PID 2444 wrote to memory of 1488 2444 cmd.exe 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe PID 4820 wrote to memory of 5008 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 4820 wrote to memory of 5008 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 4820 wrote to memory of 5008 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 4820 wrote to memory of 1644 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 4820 wrote to memory of 1644 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 4820 wrote to memory of 1644 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 4820 wrote to memory of 2828 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 4820 wrote to memory of 2828 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 4820 wrote to memory of 2828 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 4820 wrote to memory of 3864 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 4820 wrote to memory of 3864 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 4820 wrote to memory of 3864 4820 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 3864 wrote to memory of 3604 3864 cmd.exe cscript.exe PID 3864 wrote to memory of 3604 3864 cmd.exe cscript.exe PID 3864 wrote to memory of 3604 3864 cmd.exe cscript.exe PID 1488 wrote to memory of 3688 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 1488 wrote to memory of 3688 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 1488 wrote to memory of 3688 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 3688 wrote to memory of 2368 3688 cmd.exe 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe PID 3688 wrote to memory of 2368 3688 cmd.exe 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe PID 3688 wrote to memory of 2368 3688 cmd.exe 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe PID 1488 wrote to memory of 4868 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 1488 wrote to memory of 4868 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 1488 wrote to memory of 4868 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 1488 wrote to memory of 3184 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 1488 wrote to memory of 3184 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 1488 wrote to memory of 3184 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 1488 wrote to memory of 4916 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 1488 wrote to memory of 4916 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 1488 wrote to memory of 4916 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 1488 wrote to memory of 2608 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 1488 wrote to memory of 2608 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 1488 wrote to memory of 2608 1488 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 2608 wrote to memory of 392 2608 cmd.exe cscript.exe PID 2608 wrote to memory of 392 2608 cmd.exe cscript.exe PID 2608 wrote to memory of 392 2608 cmd.exe cscript.exe PID 2368 wrote to memory of 432 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 2368 wrote to memory of 432 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 2368 wrote to memory of 432 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe PID 432 wrote to memory of 2820 432 cmd.exe 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe PID 432 wrote to memory of 2820 432 cmd.exe 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe PID 432 wrote to memory of 2820 432 cmd.exe 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe PID 2368 wrote to memory of 944 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 2368 wrote to memory of 944 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 2368 wrote to memory of 944 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 2368 wrote to memory of 3296 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 2368 wrote to memory of 3296 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 2368 wrote to memory of 3296 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 2368 wrote to memory of 544 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 2368 wrote to memory of 544 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 2368 wrote to memory of 544 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe reg.exe PID 2368 wrote to memory of 3944 2368 2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\NyowAkUY\koYEAMgA.exe"C:\Users\Admin\NyowAkUY\koYEAMgA.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1404 -
C:\ProgramData\ZKgAsgUI\qUUggUAs.exe"C:\ProgramData\ZKgAsgUI\qUUggUAs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"8⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"10⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"12⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"14⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"16⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"18⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"20⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"22⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"24⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"26⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"28⤵PID:3360
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"30⤵PID:2632
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"32⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock33⤵PID:892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"34⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock35⤵PID:4148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"36⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock37⤵PID:4652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"38⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock39⤵PID:4696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"40⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock41⤵PID:3040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"42⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock43⤵PID:1988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"44⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock45⤵PID:3956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"46⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock47⤵PID:2076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"48⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock49⤵PID:4768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"50⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock51⤵PID:1644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"52⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock53⤵PID:3460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"54⤵PID:4288
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock55⤵PID:3764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"56⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock57⤵PID:4672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"58⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock59⤵PID:1084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"60⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock61⤵PID:4396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"62⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock63⤵PID:2028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"64⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock65⤵PID:4240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"66⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock67⤵PID:4048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"68⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock69⤵PID:2560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"70⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock71⤵PID:2792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"72⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock73⤵PID:1068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"74⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock75⤵PID:4424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"76⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock77⤵PID:1472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"78⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock79⤵PID:5008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"80⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock81⤵PID:2512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"82⤵PID:2248
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock83⤵PID:4776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"84⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock85⤵PID:4220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"86⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock87⤵PID:2032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"88⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock89⤵PID:772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"90⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock91⤵PID:492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"92⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock93⤵PID:2948
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"94⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock95⤵PID:1904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"96⤵PID:1912
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock97⤵PID:2912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"98⤵PID:2016
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock99⤵PID:2368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"100⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock101⤵PID:4424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"102⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock103⤵PID:2004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"104⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock105⤵PID:2680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"106⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock107⤵PID:1820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"108⤵PID:5016
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock109⤵PID:2508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"110⤵PID:3724
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock111⤵PID:3516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"112⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock113⤵PID:2176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"114⤵PID:2396
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock115⤵PID:992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"116⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock117⤵PID:944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"118⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock119⤵PID:3724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"120⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock121⤵PID:2104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"122⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock123⤵PID:1944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"124⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock125⤵PID:1748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"126⤵PID:3864
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1127⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock127⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"128⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock129⤵PID:1236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"130⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock131⤵PID:744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"132⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock133⤵PID:2112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"134⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock135⤵PID:2680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"136⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock137⤵PID:224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"138⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock139⤵PID:1816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"140⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock141⤵PID:2744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"142⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock143⤵PID:2032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"144⤵PID:704
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1145⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock145⤵PID:4356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"146⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock147⤵PID:2484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"148⤵PID:3544
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1149⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock149⤵PID:1420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"150⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock151⤵PID:3656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"152⤵PID:4960
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1153⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock153⤵PID:2436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"154⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock155⤵PID:4844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"156⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock157⤵PID:3724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"158⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock159⤵PID:4416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"160⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock161⤵PID:3184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"162⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock163⤵PID:2468
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"164⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock165⤵PID:3564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"166⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock167⤵PID:2664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"168⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock169⤵PID:568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"170⤵PID:4844
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1171⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock171⤵PID:3824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"172⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock173⤵PID:5068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"174⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock175⤵PID:2772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"176⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock177⤵PID:2724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"178⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock179⤵PID:1224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"180⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock181⤵PID:3040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"182⤵PID:3516
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1183⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock183⤵PID:2288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"184⤵PID:3460
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1185⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock185⤵PID:1688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"186⤵PID:2272
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1187⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock187⤵PID:1936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"188⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock189⤵PID:4016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"190⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock191⤵PID:3764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"192⤵PID:1032
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1193⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock193⤵PID:4320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"194⤵PID:2176
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1195⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock195⤵PID:1560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"196⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock197⤵PID:4424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"198⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock199⤵PID:2272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"200⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock201⤵PID:4168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"202⤵PID:1748
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock203⤵PID:712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"204⤵PID:1544
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1205⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock205⤵PID:4844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"206⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock207⤵PID:2284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"208⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock209⤵PID:3344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"210⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock211⤵PID:5008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"212⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock213⤵PID:4576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"214⤵PID:2184
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1215⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock215⤵PID:1368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"216⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock217⤵PID:3720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"218⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock219⤵PID:1992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"220⤵PID:1924
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1221⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock221⤵PID:2876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"222⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock223⤵PID:1044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"224⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock225⤵PID:924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"226⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock227⤵PID:4580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"228⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock229⤵PID:224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"230⤵PID:1008
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock231⤵PID:3824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"232⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock233⤵PID:4100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"234⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock235⤵PID:2100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"236⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock237⤵PID:732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"238⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock239⤵PID:3944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock"240⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_133a8c1a28986426d2eb0ba6daf4756e_virlock241⤵PID:5080
-