Analysis
-
max time kernel
162s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 11:43
Behavioral task
behavioral1
Sample
2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe
-
Size
164KB
-
MD5
d6e0ac2dad377548df7a1bc100552f83
-
SHA1
abf37bb9d34e27907c1caf2f32a4fa74a839fb75
-
SHA256
4b55af0b4dc465f8602b815562f7ee3373eae6a4d8e840ffa3f3d5ebdc4cd57e
-
SHA512
07cfb1ec1784ff21498aa3144139236d9afac2c6f1ae3443bf2a329d194e5b9dcd0dd840247a0425c7c2f3553cad58173c436013f5b4fcb383702fd4cc3516d5
-
SSDEEP
3072:/WjS5wmhTYXuQ+jsWQvhZ4aSqziwPhR2TdUyhY/H4sjDf8oyQZiLeBcxuyQ2pu0n:/u78YXuQ+UfdjsY/YsjDf8TQPSK2k0e4
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (79) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1040-0-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1040-19-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4908-21-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/912-30-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4908-33-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2316-41-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/912-44-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3932-52-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2316-56-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3932-68-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1672-80-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1552-91-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4232-92-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4840-101-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4232-105-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3816-114-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4840-118-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3008-129-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3816-130-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3008-141-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2996-151-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4896-155-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2996-166-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3012-177-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2192-178-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2192-189-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2708-190-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1624-203-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2708-204-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1624-215-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1676-223-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4472-227-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1676-241-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3980-254-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4656-251-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4860-264-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4656-265-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4860-274-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2924-276-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1920-282-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2924-285-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1920-293-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1128-301-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1712-311-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4416-312-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4416-320-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3736-321-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3736-330-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4104-333-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4104-340-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3448-342-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3448-349-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1688-352-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1688-360-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2072-361-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2072-369-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/1828-378-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4308-379-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4308-388-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2056-389-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/2056-397-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3892-398-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/3892-407-0x0000000000400000-0x000000000043B000-memory.dmp UPX behavioral2/memory/4680-409-0x0000000000400000-0x000000000043B000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation foQkUccc.exe -
Executes dropped EXE 2 IoCs
pid Process 3360 foQkUccc.exe 4848 HIgkEkcU.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1040-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1040-19-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4908-21-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/912-30-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4908-33-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2316-41-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/912-44-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3932-52-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2316-56-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3932-68-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1672-80-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1552-91-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4232-92-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4840-101-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4232-105-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3816-114-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4840-118-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3008-129-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3816-130-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3008-141-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2996-151-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4896-155-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2996-166-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3012-177-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2192-178-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2192-189-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2708-190-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1624-203-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2708-204-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1624-215-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1676-223-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4472-227-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1676-241-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3980-254-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4656-251-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4860-264-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4656-265-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4860-274-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2924-276-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1920-282-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2924-285-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1920-293-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1128-301-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1712-311-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4416-312-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4416-320-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3736-321-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3736-330-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4104-333-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4104-340-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3448-342-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3448-349-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1688-352-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1688-360-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2072-361-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2072-369-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/1828-378-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4308-379-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4308-388-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2056-389-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2056-397-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3892-398-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3892-407-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4680-409-0x0000000000400000-0x000000000043B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HIgkEkcU.exe = "C:\\ProgramData\\HkAQogYk\\HIgkEkcU.exe" HIgkEkcU.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foQkUccc.exe = "C:\\Users\\Admin\\DyYIUwYA\\foQkUccc.exe" 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HIgkEkcU.exe = "C:\\ProgramData\\HkAQogYk\\HIgkEkcU.exe" 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foQkUccc.exe = "C:\\Users\\Admin\\DyYIUwYA\\foQkUccc.exe" foQkUccc.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe foQkUccc.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe foQkUccc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 736 reg.exe 1272 reg.exe 2960 reg.exe 2932 reg.exe 4756 reg.exe 1676 reg.exe 1624 reg.exe 1872 reg.exe 4628 reg.exe 5044 reg.exe 2008 reg.exe 4416 reg.exe 3968 reg.exe 2064 reg.exe 4144 reg.exe 1672 reg.exe 3572 reg.exe 2676 reg.exe 4584 reg.exe 3280 reg.exe 3108 reg.exe 2388 reg.exe 1720 reg.exe 1184 reg.exe 4308 reg.exe 4540 reg.exe 4232 reg.exe 4620 reg.exe 3080 reg.exe 1064 reg.exe 4764 reg.exe 3084 reg.exe 4460 reg.exe 3996 reg.exe 3588 reg.exe 1272 reg.exe 4224 reg.exe 1404 reg.exe 800 reg.exe 5096 reg.exe 4472 reg.exe 3540 reg.exe 1496 reg.exe 3744 reg.exe 1672 reg.exe 3520 reg.exe 4944 reg.exe 4116 reg.exe 1720 reg.exe 4020 reg.exe 2248 reg.exe 3580 reg.exe 4668 reg.exe 2464 reg.exe 64 reg.exe 3980 reg.exe 4016 reg.exe 4524 reg.exe 912 reg.exe 3024 reg.exe 1456 reg.exe 4472 reg.exe 1192 reg.exe 3024 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2316 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2316 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2316 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2316 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3932 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3932 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3932 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3932 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 1672 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 1672 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 1672 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 1672 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 1552 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 1552 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 1552 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 1552 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4232 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4232 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4232 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4232 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4840 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4840 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4840 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4840 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3816 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3816 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3816 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3816 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3008 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3008 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3008 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3008 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4896 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4896 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4896 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 4896 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2996 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2996 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2996 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2996 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3012 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3012 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3012 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 3012 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2192 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2192 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2192 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2192 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2708 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2708 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2708 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 2708 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3360 foQkUccc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe 3360 foQkUccc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1040 wrote to memory of 3360 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 87 PID 1040 wrote to memory of 3360 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 87 PID 1040 wrote to memory of 3360 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 87 PID 1040 wrote to memory of 4848 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 89 PID 1040 wrote to memory of 4848 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 89 PID 1040 wrote to memory of 4848 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 89 PID 1040 wrote to memory of 3012 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 90 PID 1040 wrote to memory of 3012 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 90 PID 1040 wrote to memory of 3012 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 90 PID 1040 wrote to memory of 4628 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 92 PID 1040 wrote to memory of 4628 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 92 PID 1040 wrote to memory of 4628 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 92 PID 1040 wrote to memory of 4048 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 93 PID 1040 wrote to memory of 4048 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 93 PID 1040 wrote to memory of 4048 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 93 PID 1040 wrote to memory of 1680 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 94 PID 1040 wrote to memory of 1680 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 94 PID 1040 wrote to memory of 1680 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 94 PID 1040 wrote to memory of 440 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 95 PID 1040 wrote to memory of 440 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 95 PID 1040 wrote to memory of 440 1040 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 95 PID 3012 wrote to memory of 4908 3012 cmd.exe 100 PID 3012 wrote to memory of 4908 3012 cmd.exe 100 PID 3012 wrote to memory of 4908 3012 cmd.exe 100 PID 440 wrote to memory of 4232 440 cmd.exe 101 PID 440 wrote to memory of 4232 440 cmd.exe 101 PID 440 wrote to memory of 4232 440 cmd.exe 101 PID 4908 wrote to memory of 1684 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 102 PID 4908 wrote to memory of 1684 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 102 PID 4908 wrote to memory of 1684 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 102 PID 1684 wrote to memory of 912 1684 cmd.exe 104 PID 1684 wrote to memory of 912 1684 cmd.exe 104 PID 1684 wrote to memory of 912 1684 cmd.exe 104 PID 4908 wrote to memory of 3336 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 105 PID 4908 wrote to memory of 3336 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 105 PID 4908 wrote to memory of 3336 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 105 PID 4908 wrote to memory of 1288 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 162 PID 4908 wrote to memory of 1288 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 162 PID 4908 wrote to memory of 1288 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 162 PID 4908 wrote to memory of 4532 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 107 PID 4908 wrote to memory of 4532 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 107 PID 4908 wrote to memory of 4532 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 107 PID 4908 wrote to memory of 940 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 108 PID 4908 wrote to memory of 940 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 108 PID 4908 wrote to memory of 940 4908 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 108 PID 940 wrote to memory of 3364 940 cmd.exe 113 PID 940 wrote to memory of 3364 940 cmd.exe 113 PID 940 wrote to memory of 3364 940 cmd.exe 113 PID 912 wrote to memory of 1468 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 114 PID 912 wrote to memory of 1468 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 114 PID 912 wrote to memory of 1468 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 114 PID 1468 wrote to memory of 2316 1468 cmd.exe 116 PID 1468 wrote to memory of 2316 1468 cmd.exe 116 PID 1468 wrote to memory of 2316 1468 cmd.exe 116 PID 912 wrote to memory of 5044 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 117 PID 912 wrote to memory of 5044 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 117 PID 912 wrote to memory of 5044 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 117 PID 912 wrote to memory of 5096 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 118 PID 912 wrote to memory of 5096 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 118 PID 912 wrote to memory of 5096 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 118 PID 912 wrote to memory of 4836 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 119 PID 912 wrote to memory of 4836 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 119 PID 912 wrote to memory of 4836 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 119 PID 912 wrote to memory of 4128 912 2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe 193
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\DyYIUwYA\foQkUccc.exe"C:\Users\Admin\DyYIUwYA\foQkUccc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3360
-
-
C:\ProgramData\HkAQogYk\HIgkEkcU.exe"C:\ProgramData\HkAQogYk\HIgkEkcU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4848
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"8⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"10⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"12⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"14⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"16⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"18⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"20⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"22⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"24⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"26⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"28⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"30⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"32⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock33⤵PID:1624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"34⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock35⤵PID:4472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"36⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock37⤵PID:1676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"38⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock39⤵PID:3980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"40⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock41⤵PID:4656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"42⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock43⤵PID:4860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"44⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock45⤵PID:2924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"46⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock47⤵PID:1920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"48⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock49⤵PID:1128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"50⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock51⤵PID:1712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"52⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock53⤵PID:4416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"54⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock55⤵PID:3736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"56⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock57⤵PID:4104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"58⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock59⤵PID:3448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"60⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock61⤵PID:1688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"62⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock63⤵PID:2072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"64⤵PID:4048
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:2888
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock65⤵PID:1828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"66⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock67⤵PID:4308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"68⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock69⤵PID:2056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"70⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock71⤵PID:3892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"72⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock73⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"74⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock75⤵PID:4884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"76⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock77⤵PID:1744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"78⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock79⤵PID:4256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"80⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock81⤵PID:4416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"82⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock83⤵PID:1300
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"84⤵PID:3724
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵PID:4112
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock85⤵PID:1128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"86⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock87⤵PID:2636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"88⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock89⤵PID:4880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"90⤵PID:1560
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵PID:4416
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock91⤵PID:2216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"92⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock93⤵PID:4916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"94⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock95⤵PID:4796
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"96⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock97⤵PID:4232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"98⤵PID:1076
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:1588
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock99⤵PID:4832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"100⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock101⤵PID:3448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"102⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock103⤵PID:3032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"104⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock105⤵PID:2208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"106⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock107⤵PID:1408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"108⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock109⤵PID:4916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"110⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock111⤵PID:64
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"112⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock113⤵PID:4264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"114⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock115⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"116⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock117⤵PID:3924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"118⤵PID:4144
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵PID:3996
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock119⤵PID:2184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"120⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock121⤵PID:4364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-03_d6e0ac2dad377548df7a1bc100552f83_virlock"122⤵PID:3376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-