Analysis
-
max time kernel
150s -
max time network
59s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 16:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe
-
Size
203KB
-
MD5
bb58b8f9026bd66985f7ea212561022a
-
SHA1
c15422826787e085d0d7b3fcfd1d7f0adb68143d
-
SHA256
29b205cd7255ed3a9a1078bd396dafe33966ebe5a289881a7f169eabd76ac5ed
-
SHA512
c4ce24fd55664934f09354e822b9051f90fa84079da30185142b5469d711d1af244b0cf4bc2689f801c9c38da2a88dcabc8d85044f5a1bc30df9044bebfe4d67
-
SSDEEP
6144:ccevyodMBtHBEPLW7VinSBth+3mJLi9FM9QU2hwnkptBhmiX:cLeBtHBEPLW7VinSBth+3cLi9XU2h2i7
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (54) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\International\Geo\Nation zokgYwgw.exe -
Deletes itself 1 IoCs
pid Process 2800 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2772 zokgYwgw.exe 2808 RaEEoIoU.exe -
Loads dropped DLL 20 IoCs
pid Process 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\zokgYwgw.exe = "C:\\Users\\Admin\\iGoowsYo\\zokgYwgw.exe" zokgYwgw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RaEEoIoU.exe = "C:\\ProgramData\\ScYcMwcM\\RaEEoIoU.exe" RaEEoIoU.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\zokgYwgw.exe = "C:\\Users\\Admin\\iGoowsYo\\zokgYwgw.exe" 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RaEEoIoU.exe = "C:\\ProgramData\\ScYcMwcM\\RaEEoIoU.exe" 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico zokgYwgw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2736 reg.exe 2612 reg.exe 1632 reg.exe 884 reg.exe 868 reg.exe 1628 reg.exe 2736 reg.exe 692 reg.exe 2036 reg.exe 1948 reg.exe 1980 reg.exe 2708 reg.exe 2788 reg.exe 1668 reg.exe 2904 reg.exe 492 reg.exe 2400 reg.exe 1160 reg.exe 644 reg.exe 1340 reg.exe 1096 reg.exe 892 reg.exe 1628 reg.exe 2564 reg.exe 1572 reg.exe 1676 reg.exe 2604 reg.exe 1236 reg.exe 1516 reg.exe 1404 reg.exe 2656 reg.exe 1668 reg.exe 2524 reg.exe 2556 reg.exe 2912 reg.exe 2608 reg.exe 1572 reg.exe 2516 reg.exe 2716 reg.exe 2780 reg.exe 2996 reg.exe 2108 reg.exe 2996 reg.exe 2744 reg.exe 1344 reg.exe 304 reg.exe 580 reg.exe 2264 reg.exe 1680 reg.exe 2928 reg.exe 1676 reg.exe 824 reg.exe 580 reg.exe 1892 reg.exe 2280 reg.exe 2592 reg.exe 2920 reg.exe 1812 reg.exe 916 reg.exe 2068 reg.exe 1516 reg.exe 2636 reg.exe 1572 reg.exe 2804 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1632 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1632 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 576 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 576 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 976 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 976 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2256 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2256 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2420 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2420 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2572 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2572 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 692 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 692 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2040 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2040 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2452 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2452 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 988 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 988 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2804 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2804 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2540 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2540 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2408 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2408 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 840 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 840 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1448 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1448 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2996 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2996 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2940 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2940 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1904 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1904 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1588 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1588 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2980 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2980 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1764 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1764 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1964 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1964 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2868 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2868 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2124 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2124 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 816 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 816 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1924 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 1924 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2684 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2684 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2580 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2580 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2880 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 2880 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2772 zokgYwgw.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe 2772 zokgYwgw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2772 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 30 PID 2636 wrote to memory of 2772 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 30 PID 2636 wrote to memory of 2772 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 30 PID 2636 wrote to memory of 2772 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 30 PID 2636 wrote to memory of 2808 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 31 PID 2636 wrote to memory of 2808 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 31 PID 2636 wrote to memory of 2808 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 31 PID 2636 wrote to memory of 2808 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 31 PID 2636 wrote to memory of 2852 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 32 PID 2636 wrote to memory of 2852 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 32 PID 2636 wrote to memory of 2852 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 32 PID 2636 wrote to memory of 2852 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 32 PID 2636 wrote to memory of 2556 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 34 PID 2636 wrote to memory of 2556 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 34 PID 2636 wrote to memory of 2556 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 34 PID 2636 wrote to memory of 2556 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 34 PID 2636 wrote to memory of 2664 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 35 PID 2636 wrote to memory of 2664 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 35 PID 2636 wrote to memory of 2664 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 35 PID 2636 wrote to memory of 2664 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 35 PID 2636 wrote to memory of 2696 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 36 PID 2636 wrote to memory of 2696 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 36 PID 2636 wrote to memory of 2696 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 36 PID 2636 wrote to memory of 2696 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 36 PID 2636 wrote to memory of 2524 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 37 PID 2636 wrote to memory of 2524 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 37 PID 2636 wrote to memory of 2524 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 37 PID 2636 wrote to memory of 2524 2636 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 37 PID 2852 wrote to memory of 2544 2852 cmd.exe 38 PID 2852 wrote to memory of 2544 2852 cmd.exe 38 PID 2852 wrote to memory of 2544 2852 cmd.exe 38 PID 2852 wrote to memory of 2544 2852 cmd.exe 38 PID 2524 wrote to memory of 2840 2524 cmd.exe 43 PID 2524 wrote to memory of 2840 2524 cmd.exe 43 PID 2524 wrote to memory of 2840 2524 cmd.exe 43 PID 2524 wrote to memory of 2840 2524 cmd.exe 43 PID 2544 wrote to memory of 2124 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 44 PID 2544 wrote to memory of 2124 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 44 PID 2544 wrote to memory of 2124 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 44 PID 2544 wrote to memory of 2124 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 44 PID 2544 wrote to memory of 2036 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 47 PID 2544 wrote to memory of 2036 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 47 PID 2544 wrote to memory of 2036 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 47 PID 2544 wrote to memory of 2036 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 47 PID 2124 wrote to memory of 1632 2124 cmd.exe 46 PID 2124 wrote to memory of 1632 2124 cmd.exe 46 PID 2124 wrote to memory of 1632 2124 cmd.exe 46 PID 2124 wrote to memory of 1632 2124 cmd.exe 46 PID 2544 wrote to memory of 1052 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 48 PID 2544 wrote to memory of 1052 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 48 PID 2544 wrote to memory of 1052 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 48 PID 2544 wrote to memory of 1052 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 48 PID 2544 wrote to memory of 1988 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 50 PID 2544 wrote to memory of 1988 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 50 PID 2544 wrote to memory of 1988 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 50 PID 2544 wrote to memory of 1988 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 50 PID 2544 wrote to memory of 2744 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 51 PID 2544 wrote to memory of 2744 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 51 PID 2544 wrote to memory of 2744 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 51 PID 2544 wrote to memory of 2744 2544 2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe 51 PID 2744 wrote to memory of 2916 2744 cmd.exe 55 PID 2744 wrote to memory of 2916 2744 cmd.exe 55 PID 2744 wrote to memory of 2916 2744 cmd.exe 55 PID 2744 wrote to memory of 2916 2744 cmd.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\iGoowsYo\zokgYwgw.exe"C:\Users\Admin\iGoowsYo\zokgYwgw.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2772
-
-
C:\ProgramData\ScYcMwcM\RaEEoIoU.exe"C:\ProgramData\ScYcMwcM\RaEEoIoU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2808
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"6⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:576 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"8⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:976 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"10⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2256 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"12⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:2420 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"14⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"16⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:692 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"18⤵
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"20⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2452 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"22⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:988 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"24⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2804 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"26⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2540 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"28⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2408 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"30⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:840 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"32⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1448 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"34⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:2996 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"36⤵
- System Location Discovery: System Language Discovery
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock37⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2940 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"38⤵
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2544 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"40⤵
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"42⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:1588 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"44⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2980 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"46⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:1764 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"48⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:1964 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"50⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"52⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"54⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:816 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"56⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"58⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:2684 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"60⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2580 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"62⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2880 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"64⤵
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock65⤵PID:2884
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"66⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock67⤵PID:1596
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"68⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock69⤵PID:580
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"70⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock71⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"72⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock73⤵PID:2324
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"74⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock75⤵PID:2208
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"76⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock77⤵PID:292
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"78⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock79⤵PID:1632
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"80⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock81⤵PID:1772
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"82⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock83⤵PID:2984
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"84⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock85⤵PID:2548
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"86⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock87⤵PID:1068
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"88⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock89⤵PID:2588
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"90⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock91⤵PID:1972
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"92⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock93⤵PID:1084
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"94⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock95⤵PID:2764
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"96⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock97⤵PID:1964
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"98⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock99⤵PID:2416
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"100⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock101⤵PID:2084
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"102⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock103⤵PID:2984
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"104⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock105⤵PID:2656
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"106⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock107⤵PID:1884
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"108⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock109⤵PID:2848
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"110⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock111⤵PID:824
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"112⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock113⤵PID:1736
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"114⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock115⤵PID:1412
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"116⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock117⤵PID:2308
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"118⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock119⤵
- System Location Discovery: System Language Discovery
PID:316 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"120⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock121⤵PID:2576
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-09-13_bb58b8f9026bd66985f7ea212561022a_virlock"122⤵PID:2324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-