Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 11:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe
-
Size
230KB
-
MD5
37ab5c2f946961041bdcb47e5250f5b1
-
SHA1
885943dcc66d61113ece8dc0acd0abcb4145d97e
-
SHA256
ea7fa0bc70c75c1528ec1c51a52872ab5fd55b34b2e95003c96bcc089c70998d
-
SHA512
614e33efd4a2265223613732ad8ad04cde0b5d4b22ebb3fc2400ec7b884931496865305a0b825b3d725127b3b2f1c8461e076e385c117a8881cca734c4b2601b
-
SSDEEP
6144:g4XWtbS6ypV3axXT3c5TsESgQ96k1AOcW:JXQbSX367eJBkeNW
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dykIAIsA.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation dykIAIsA.exe -
Executes dropped EXE 2 IoCs
Processes:
wgkokgUk.exedykIAIsA.exepid process 2416 wgkokgUk.exe 228 dykIAIsA.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exedykIAIsA.exewgkokgUk.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wgkokgUk.exe = "C:\\Users\\Admin\\sOYkksAQ\\wgkokgUk.exe" 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dykIAIsA.exe = "C:\\ProgramData\\GyYYAQkY\\dykIAIsA.exe" 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dykIAIsA.exe = "C:\\ProgramData\\GyYYAQkY\\dykIAIsA.exe" dykIAIsA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wgkokgUk.exe = "C:\\Users\\Admin\\sOYkksAQ\\wgkokgUk.exe" wgkokgUk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YugEokwQ.exe = "C:\\Users\\Admin\\pIIEsMYY\\YugEokwQ.exe" 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OuccUEIs.exe = "C:\\ProgramData\\dAoYUAkI\\OuccUEIs.exe" 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe -
Drops file in System32 directory 2 IoCs
Processes:
dykIAIsA.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe dykIAIsA.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe dykIAIsA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3816 4616 WerFault.exe YugEokwQ.exe 232 2164 WerFault.exe OuccUEIs.exe -
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4184 4844 reg.exe 3036 reg.exe 744 reg.exe 216 reg.exe 1900 reg.exe 4760 reg.exe 2284 reg.exe 4988 reg.exe 4968 reg.exe 4228 reg.exe 552 428 reg.exe 2672 reg.exe 3724 reg.exe 2164 reg.exe 4708 reg.exe 1812 reg.exe 1220 reg.exe 2516 reg.exe 1904 reg.exe 1596 reg.exe 2672 reg.exe 1812 reg.exe 4544 reg.exe 2996 reg.exe 4536 reg.exe 4624 reg.exe 4620 reg.exe 1956 reg.exe 2832 4396 804 reg.exe 4996 reg.exe 3620 reg.exe 380 reg.exe 4120 5004 reg.exe 3600 reg.exe 3724 reg.exe 4688 reg.exe 1112 reg.exe 2568 2780 reg.exe 3372 reg.exe 4428 reg.exe 2832 1568 reg.exe 3928 reg.exe 3600 4760 1596 reg.exe 4108 reg.exe 4396 reg.exe 2520 reg.exe 3300 reg.exe 2960 reg.exe 1896 reg.exe 4712 reg.exe 2568 reg.exe 1812 3928 reg.exe 4756 4440 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exepid process 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4432 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4432 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4432 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4432 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 1904 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 1904 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 1904 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 1904 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 2396 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 2396 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 2396 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 2396 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3036 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3036 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3036 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3036 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3972 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3972 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3972 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3972 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4108 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4108 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4108 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4108 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4616 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4616 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4616 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4616 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3864 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3864 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3864 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3864 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 432 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 432 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 432 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 432 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4464 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4464 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4464 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4464 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3632 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3632 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3632 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 3632 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 2248 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 2248 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 2248 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 2248 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4108 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4108 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4108 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe 4108 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dykIAIsA.exepid process 228 dykIAIsA.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
dykIAIsA.exepid process 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe 228 dykIAIsA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.execmd.execmd.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.execmd.execmd.exe2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.execmd.exedescription pid process target process PID 1176 wrote to memory of 2416 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe wgkokgUk.exe PID 1176 wrote to memory of 2416 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe wgkokgUk.exe PID 1176 wrote to memory of 2416 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe wgkokgUk.exe PID 1176 wrote to memory of 228 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe dykIAIsA.exe PID 1176 wrote to memory of 228 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe dykIAIsA.exe PID 1176 wrote to memory of 228 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe dykIAIsA.exe PID 1176 wrote to memory of 540 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 1176 wrote to memory of 540 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 1176 wrote to memory of 540 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 1176 wrote to memory of 3956 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 1176 wrote to memory of 3956 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 1176 wrote to memory of 3956 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 1176 wrote to memory of 5004 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 1176 wrote to memory of 5004 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 1176 wrote to memory of 5004 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 1176 wrote to memory of 1360 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 1176 wrote to memory of 1360 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 1176 wrote to memory of 1360 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 1176 wrote to memory of 3472 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 1176 wrote to memory of 3472 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 1176 wrote to memory of 3472 1176 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 540 wrote to memory of 936 540 cmd.exe 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe PID 540 wrote to memory of 936 540 cmd.exe 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe PID 540 wrote to memory of 936 540 cmd.exe 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe PID 3472 wrote to memory of 3972 3472 cmd.exe cscript.exe PID 3472 wrote to memory of 3972 3472 cmd.exe cscript.exe PID 3472 wrote to memory of 3972 3472 cmd.exe cscript.exe PID 936 wrote to memory of 4960 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 936 wrote to memory of 4960 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 936 wrote to memory of 4960 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 4960 wrote to memory of 4544 4960 cmd.exe 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe PID 4960 wrote to memory of 4544 4960 cmd.exe 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe PID 4960 wrote to memory of 4544 4960 cmd.exe 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe PID 936 wrote to memory of 2396 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 936 wrote to memory of 2396 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 936 wrote to memory of 2396 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 936 wrote to memory of 2832 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 936 wrote to memory of 2832 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 936 wrote to memory of 2832 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 936 wrote to memory of 428 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 936 wrote to memory of 428 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 936 wrote to memory of 428 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 936 wrote to memory of 3268 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 936 wrote to memory of 3268 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 936 wrote to memory of 3268 936 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 3268 wrote to memory of 432 3268 cmd.exe cscript.exe PID 3268 wrote to memory of 432 3268 cmd.exe cscript.exe PID 3268 wrote to memory of 432 3268 cmd.exe cscript.exe PID 4544 wrote to memory of 2292 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 4544 wrote to memory of 2292 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 4544 wrote to memory of 2292 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 4544 wrote to memory of 3248 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 4544 wrote to memory of 3248 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 4544 wrote to memory of 3248 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 4544 wrote to memory of 4844 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 4544 wrote to memory of 4844 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 4544 wrote to memory of 4844 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 4544 wrote to memory of 2264 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 4544 wrote to memory of 2264 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 4544 wrote to memory of 2264 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe reg.exe PID 4544 wrote to memory of 2472 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 4544 wrote to memory of 2472 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 4544 wrote to memory of 2472 4544 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe cmd.exe PID 2292 wrote to memory of 4432 2292 cmd.exe 2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\sOYkksAQ\wgkokgUk.exe"C:\Users\Admin\sOYkksAQ\wgkokgUk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\GyYYAQkY\dykIAIsA.exe"C:\ProgramData\GyYYAQkY\dykIAIsA.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"22⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"32⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"34⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"52⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"58⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"74⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"78⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"80⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"84⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"88⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"110⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"116⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"120⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock121⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"122⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1123⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock123⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"124⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1125⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock125⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"126⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1127⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock127⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"128⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1129⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock129⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"130⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"132⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1133⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"134⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock135⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"136⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"138⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"140⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock141⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"142⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1143⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"144⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"146⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1147⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"148⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"150⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1151⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"152⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"154⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1155⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"156⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"158⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"160⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1161⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"162⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"164⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1165⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"166⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1167⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"168⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1169⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock169⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"170⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"172⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"174⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"176⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1177⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"178⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1179⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"180⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1181⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"182⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"184⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"186⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock187⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"188⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"190⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"192⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1193⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"194⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"196⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"198⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1199⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock199⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"200⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"202⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1203⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock203⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"204⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1205⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"206⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1207⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock207⤵
- Adds Run key to start application
-
C:\Users\Admin\pIIEsMYY\YugEokwQ.exe"C:\Users\Admin\pIIEsMYY\YugEokwQ.exe"208⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 224209⤵
- Program crash
-
C:\ProgramData\dAoYUAkI\OuccUEIs.exe"C:\ProgramData\dAoYUAkI\OuccUEIs.exe"208⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 224209⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"208⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"210⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"212⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"214⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1215⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"216⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1217⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"218⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1219⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"220⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock221⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"222⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"224⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"226⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"228⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"230⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1231⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"232⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"234⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1235⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock235⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"236⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"238⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock"240⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-05-25_37ab5c2f946961041bdcb47e5250f5b1_virlock241⤵