Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 10:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe
-
Size
117KB
-
MD5
7f7f8daffd0393693e67969ab2723f0c
-
SHA1
ca2c0fcc4d37f0eb37179fcb1acb448da024269c
-
SHA256
5a0630b5158d1cf91a46ae0ec99ccb8d1983eb3070b7c422bc31a75be9af3940
-
SHA512
e550dc22ff11820d7a02f8e50cb91afeae3fa0b46669e6a31aa00d3901309faad6d53afad79be9270df50a42e013373d76910d1463b770a09d881bcbb0379dba
-
SSDEEP
1536:cVpMBh63xyp6UE7e/MUVv+stPTfe8XSJbOfef0fbfufZfvfNf3f/EcQz7q9zmo3q:K2hWyp6UMUh+MbfeYv7qJmQwJwMp5Kq
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
vugMIYsU.exesAEkAUwc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation vugMIYsU.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation sAEkAUwc.exe -
Executes dropped EXE 2 IoCs
Processes:
sAEkAUwc.exevugMIYsU.exepid process 3236 sAEkAUwc.exe 1400 vugMIYsU.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
vugMIYsU.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exesAEkAUwc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vugMIYsU.exe = "C:\\ProgramData\\rCwsgIEI\\vugMIYsU.exe" vugMIYsU.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sAEkAUwc.exe = "C:\\Users\\Admin\\lOkggAMY\\sAEkAUwc.exe" 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vugMIYsU.exe = "C:\\ProgramData\\rCwsgIEI\\vugMIYsU.exe" 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sAEkAUwc.exe = "C:\\Users\\Admin\\lOkggAMY\\sAEkAUwc.exe" sAEkAUwc.exe -
Drops file in System32 directory 1 IoCs
Processes:
sAEkAUwc.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe sAEkAUwc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 3232 reg.exe 2424 reg.exe 5104 reg.exe 3676 reg.exe 4692 reg.exe 1804 reg.exe 4796 reg.exe 1076 reg.exe 4752 reg.exe 3188 reg.exe 5076 reg.exe 852 reg.exe 4040 reg.exe 1096 reg.exe 5048 reg.exe 1604 reg.exe 4944 reg.exe 4768 reg.exe 2236 reg.exe 4460 reg.exe 4748 reg.exe 4780 reg.exe 2404 reg.exe 3004 reg.exe 4692 reg.exe 3476 reg.exe 1576 reg.exe 3872 reg.exe 4408 reg.exe 4148 reg.exe 4352 reg.exe 1896 reg.exe 2284 reg.exe 4596 reg.exe 2000 reg.exe 4316 reg.exe 1644 reg.exe 3056 reg.exe 4200 reg.exe 3000 reg.exe 2876 reg.exe 4540 reg.exe 1352 reg.exe 3188 reg.exe 3384 reg.exe 1776 reg.exe 4056 reg.exe 4052 reg.exe 264 reg.exe 1240 reg.exe 4300 reg.exe 4076 reg.exe 1548 reg.exe 1516 reg.exe 3788 reg.exe 1976 reg.exe 956 reg.exe 1600 reg.exe 1804 reg.exe 4828 reg.exe 3476 reg.exe 3056 reg.exe 3624 reg.exe 3564 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exepid process 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4684 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4684 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4684 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4684 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2084 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2084 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2084 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2084 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 752 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 752 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 752 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 752 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4212 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4212 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4212 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4212 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 3660 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 3660 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 3660 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 3660 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4200 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4200 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4200 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4200 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1976 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1976 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1976 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1976 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4672 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4672 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4672 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 4672 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 3000 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 3000 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 3000 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 3000 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 516 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 516 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 516 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 516 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1748 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1748 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1748 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 1748 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2204 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2204 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2204 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2204 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2356 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2356 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2356 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe 2356 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
vugMIYsU.exesAEkAUwc.exepid process 1400 vugMIYsU.exe 3236 sAEkAUwc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
vugMIYsU.exesAEkAUwc.exepid process 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe 1400 vugMIYsU.exe 3236 sAEkAUwc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.execmd.execmd.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.execmd.execmd.exe2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.execmd.exedescription pid process target process PID 808 wrote to memory of 3236 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe sAEkAUwc.exe PID 808 wrote to memory of 3236 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe sAEkAUwc.exe PID 808 wrote to memory of 3236 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe sAEkAUwc.exe PID 808 wrote to memory of 1400 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe vugMIYsU.exe PID 808 wrote to memory of 1400 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe vugMIYsU.exe PID 808 wrote to memory of 1400 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe vugMIYsU.exe PID 808 wrote to memory of 3240 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 808 wrote to memory of 3240 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 808 wrote to memory of 3240 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 3240 wrote to memory of 2476 3240 cmd.exe 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe PID 3240 wrote to memory of 2476 3240 cmd.exe 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe PID 3240 wrote to memory of 2476 3240 cmd.exe 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe PID 808 wrote to memory of 4460 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 808 wrote to memory of 4460 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 808 wrote to memory of 4460 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 808 wrote to memory of 4480 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 808 wrote to memory of 4480 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 808 wrote to memory of 4480 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 808 wrote to memory of 1888 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 808 wrote to memory of 1888 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 808 wrote to memory of 1888 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 808 wrote to memory of 740 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 808 wrote to memory of 740 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 808 wrote to memory of 740 808 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 740 wrote to memory of 3436 740 cmd.exe cscript.exe PID 740 wrote to memory of 3436 740 cmd.exe cscript.exe PID 740 wrote to memory of 3436 740 cmd.exe cscript.exe PID 2476 wrote to memory of 4948 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 2476 wrote to memory of 4948 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 2476 wrote to memory of 4948 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 4948 wrote to memory of 1496 4948 cmd.exe 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe PID 4948 wrote to memory of 1496 4948 cmd.exe 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe PID 4948 wrote to memory of 1496 4948 cmd.exe 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe PID 2476 wrote to memory of 3788 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 2476 wrote to memory of 3788 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 2476 wrote to memory of 3788 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 2476 wrote to memory of 1592 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 2476 wrote to memory of 1592 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 2476 wrote to memory of 1592 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 2476 wrote to memory of 3736 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 2476 wrote to memory of 3736 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 2476 wrote to memory of 3736 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 2476 wrote to memory of 3868 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 2476 wrote to memory of 3868 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 2476 wrote to memory of 3868 2476 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 3868 wrote to memory of 4904 3868 cmd.exe cscript.exe PID 3868 wrote to memory of 4904 3868 cmd.exe cscript.exe PID 3868 wrote to memory of 4904 3868 cmd.exe cscript.exe PID 1496 wrote to memory of 2104 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 1496 wrote to memory of 2104 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 1496 wrote to memory of 2104 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 1496 wrote to memory of 3432 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 1496 wrote to memory of 3432 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 1496 wrote to memory of 3432 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 1496 wrote to memory of 2828 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 1496 wrote to memory of 2828 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 1496 wrote to memory of 2828 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 1496 wrote to memory of 3792 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 1496 wrote to memory of 3792 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 1496 wrote to memory of 3792 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe reg.exe PID 1496 wrote to memory of 3156 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 1496 wrote to memory of 3156 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 1496 wrote to memory of 3156 1496 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe cmd.exe PID 2104 wrote to memory of 4684 2104 cmd.exe 2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\lOkggAMY\sAEkAUwc.exe"C:\Users\Admin\lOkggAMY\sAEkAUwc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3236
-
-
C:\ProgramData\rCwsgIEI\vugMIYsU.exe"C:\ProgramData\rCwsgIEI\vugMIYsU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1400
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"8⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"10⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"12⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"14⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"16⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"18⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"20⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"22⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"24⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"26⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"28⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"30⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"32⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock33⤵PID:3596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"34⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock35⤵PID:4692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"36⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock37⤵PID:5104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"38⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock39⤵PID:3112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"40⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock41⤵PID:2616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"42⤵PID:2248
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵PID:4752
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock43⤵PID:1692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"44⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock45⤵PID:624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"46⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock47⤵PID:3384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"48⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock49⤵PID:3144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"50⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock51⤵PID:1088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"52⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock53⤵PID:2404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"54⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock55⤵PID:776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"56⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock57⤵PID:1908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"58⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock59⤵PID:3232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"60⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock61⤵PID:3132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"62⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock63⤵PID:1404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"64⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock65⤵PID:4848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"66⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock67⤵PID:3592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"68⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock69⤵PID:1812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"70⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock71⤵PID:264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"72⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock73⤵PID:680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"74⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock75⤵PID:2356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"76⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock77⤵PID:1240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"78⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock79⤵PID:3568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"80⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock81⤵PID:1516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"82⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock83⤵PID:4888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"84⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock85⤵PID:448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"86⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock87⤵PID:5036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"88⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock89⤵PID:4516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"90⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock91⤵PID:4700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"92⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock93⤵PID:2036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"94⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock95⤵PID:4040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"96⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock97⤵PID:2844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"98⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock99⤵PID:1372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"100⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock101⤵PID:1908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"102⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock103⤵PID:752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"104⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock105⤵PID:2036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"106⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock107⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"108⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock109⤵PID:5104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"110⤵PID:3124
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:4820
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock111⤵PID:956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"112⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock113⤵PID:3092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"114⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock115⤵PID:724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"116⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock117⤵PID:2744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"118⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock119⤵PID:752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"120⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock121⤵PID:3188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-04-25_7f7f8daffd0393693e67969ab2723f0c_virlock"122⤵PID:4968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-