Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/10/2024, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe
-
Size
115KB
-
MD5
7128fe39c0f51169acbbf8f33881b06b
-
SHA1
709b19abc274a0f134f60561d8bfd64fca8f2ed5
-
SHA256
1a6eb2ce513a1c92f261ab533cf7075f4d7b0fb32ad032e343dd41544ff66b81
-
SHA512
98ba998f8c5aca823afe77ab04ab453cc56ab2cccb57afbf92f16407a5b47f3e1febe3aa8b9d0bc8eeca3cabbadee8ab6e18a6e383723d08cddc4cdf8f315379
-
SSDEEP
3072:tYJpW3Unj1DXLaEAOwJi02tmq0wT0Kjr6d:opsUnj1DNPwMmrwTBw
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 63 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation WMscsAAY.exe -
Executes dropped EXE 2 IoCs
pid Process 2712 WMscsAAY.exe 1744 WmAIgwoo.exe -
Loads dropped DLL 20 IoCs
pid Process 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmAIgwoo.exe = "C:\\ProgramData\\lsswMkIU\\WmAIgwoo.exe" 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMscsAAY.exe = "C:\\Users\\Admin\\lsYAQYUU\\WMscsAAY.exe" WMscsAAY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmAIgwoo.exe = "C:\\ProgramData\\lsswMkIU\\WmAIgwoo.exe" WmAIgwoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMscsAAY.exe = "C:\\Users\\Admin\\lsYAQYUU\\WMscsAAY.exe" 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 1112 reg.exe 1404 reg.exe 2884 reg.exe 1616 reg.exe 2504 reg.exe 2528 reg.exe 956 reg.exe 2504 reg.exe 2072 reg.exe 2784 reg.exe 2716 reg.exe 112 reg.exe 1268 reg.exe 2720 reg.exe 1892 reg.exe 2660 reg.exe 1952 reg.exe 2288 reg.exe 1920 reg.exe 1868 reg.exe 1268 reg.exe 2028 reg.exe 2188 reg.exe 3000 reg.exe 2968 reg.exe 2024 reg.exe 2860 reg.exe 2900 reg.exe 1140 reg.exe 2188 reg.exe 1532 reg.exe 1048 reg.exe 2208 reg.exe 2816 reg.exe 2004 reg.exe 2904 reg.exe 2096 reg.exe 1812 reg.exe 952 reg.exe 2676 reg.exe 1172 reg.exe 2980 reg.exe 2952 reg.exe 2912 reg.exe 1260 reg.exe 2844 reg.exe 1564 reg.exe 2800 reg.exe 2268 reg.exe 840 reg.exe 1724 reg.exe 1916 reg.exe 2512 reg.exe 2052 reg.exe 2724 reg.exe 2424 reg.exe 1276 reg.exe 2796 reg.exe 2480 reg.exe 2104 reg.exe 2008 reg.exe 2496 reg.exe 2460 reg.exe 844 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2396 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2396 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1504 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1504 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1792 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1792 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1652 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1652 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2068 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2068 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 3060 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 3060 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2768 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2768 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2396 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2396 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1504 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1504 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1780 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1780 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1644 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1644 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2556 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2556 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 3060 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 3060 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1532 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1532 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1272 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1272 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2492 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2492 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2112 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2112 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2916 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2916 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1512 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1512 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1716 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1716 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1524 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1524 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1268 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1268 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 992 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 992 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2160 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2160 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2660 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2660 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2680 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2680 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2124 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2124 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2040 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 2040 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 304 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 304 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1260 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 1260 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2712 WMscsAAY.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe 2712 WMscsAAY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2712 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 30 PID 3048 wrote to memory of 2712 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 30 PID 3048 wrote to memory of 2712 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 30 PID 3048 wrote to memory of 2712 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 30 PID 3048 wrote to memory of 1744 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 31 PID 3048 wrote to memory of 1744 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 31 PID 3048 wrote to memory of 1744 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 31 PID 3048 wrote to memory of 1744 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 31 PID 3048 wrote to memory of 2736 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 32 PID 3048 wrote to memory of 2736 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 32 PID 3048 wrote to memory of 2736 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 32 PID 3048 wrote to memory of 2736 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 32 PID 2736 wrote to memory of 1952 2736 cmd.exe 34 PID 2736 wrote to memory of 1952 2736 cmd.exe 34 PID 2736 wrote to memory of 1952 2736 cmd.exe 34 PID 2736 wrote to memory of 1952 2736 cmd.exe 34 PID 3048 wrote to memory of 2840 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 35 PID 3048 wrote to memory of 2840 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 35 PID 3048 wrote to memory of 2840 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 35 PID 3048 wrote to memory of 2840 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 35 PID 3048 wrote to memory of 2844 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 36 PID 3048 wrote to memory of 2844 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 36 PID 3048 wrote to memory of 2844 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 36 PID 3048 wrote to memory of 2844 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 36 PID 3048 wrote to memory of 2904 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 38 PID 3048 wrote to memory of 2904 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 38 PID 3048 wrote to memory of 2904 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 38 PID 3048 wrote to memory of 2904 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 38 PID 3048 wrote to memory of 2756 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 40 PID 3048 wrote to memory of 2756 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 40 PID 3048 wrote to memory of 2756 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 40 PID 3048 wrote to memory of 2756 3048 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 40 PID 2756 wrote to memory of 2892 2756 cmd.exe 43 PID 2756 wrote to memory of 2892 2756 cmd.exe 43 PID 2756 wrote to memory of 2892 2756 cmd.exe 43 PID 2756 wrote to memory of 2892 2756 cmd.exe 43 PID 1952 wrote to memory of 2748 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 44 PID 1952 wrote to memory of 2748 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 44 PID 1952 wrote to memory of 2748 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 44 PID 1952 wrote to memory of 2748 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 44 PID 2748 wrote to memory of 2396 2748 cmd.exe 46 PID 2748 wrote to memory of 2396 2748 cmd.exe 46 PID 2748 wrote to memory of 2396 2748 cmd.exe 46 PID 2748 wrote to memory of 2396 2748 cmd.exe 46 PID 1952 wrote to memory of 2240 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 47 PID 1952 wrote to memory of 2240 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 47 PID 1952 wrote to memory of 2240 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 47 PID 1952 wrote to memory of 2240 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 47 PID 1952 wrote to memory of 2056 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 48 PID 1952 wrote to memory of 2056 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 48 PID 1952 wrote to memory of 2056 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 48 PID 1952 wrote to memory of 2056 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 48 PID 1952 wrote to memory of 684 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 50 PID 1952 wrote to memory of 684 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 50 PID 1952 wrote to memory of 684 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 50 PID 1952 wrote to memory of 684 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 50 PID 1952 wrote to memory of 2868 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 51 PID 1952 wrote to memory of 2868 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 51 PID 1952 wrote to memory of 2868 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 51 PID 1952 wrote to memory of 2868 1952 2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe 51 PID 2868 wrote to memory of 1496 2868 cmd.exe 55 PID 2868 wrote to memory of 1496 2868 cmd.exe 55 PID 2868 wrote to memory of 1496 2868 cmd.exe 55 PID 2868 wrote to memory of 1496 2868 cmd.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\lsYAQYUU\WMscsAAY.exe"C:\Users\Admin\lsYAQYUU\WMscsAAY.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2712
-
-
C:\ProgramData\lsswMkIU\WmAIgwoo.exe"C:\ProgramData\lsswMkIU\WmAIgwoo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1744
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"6⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1504 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"8⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1792 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"10⤵
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"12⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:2068 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"14⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:3060 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"16⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2768 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"18⤵
- System Location Discovery: System Language Discovery
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"20⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1504 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"22⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"24⤵
- System Location Discovery: System Language Discovery
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"26⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"28⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:3060 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"30⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1532 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"32⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"34⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:2492 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"36⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"38⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2916 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"40⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock41⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1512 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"42⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"44⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock45⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1524 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"46⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock47⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1268 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"48⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:992 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"50⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"52⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock53⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2660 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"54⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:2680 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"56⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"58⤵
- System Location Discovery: System Language Discovery
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"60⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock61⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:304 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"62⤵
- System Location Discovery: System Language Discovery
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:1260 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"64⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock65⤵PID:572
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"66⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock67⤵PID:2024
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"68⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock69⤵PID:2064
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"70⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock71⤵PID:2972
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"72⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock73⤵PID:2528
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"74⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock75⤵PID:2548
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"76⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock77⤵PID:2492
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"78⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock79⤵PID:2668
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"80⤵
- System Location Discovery: System Language Discovery
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock81⤵PID:2388
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"82⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock83⤵PID:2796
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"84⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock85⤵PID:1160
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"86⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock87⤵PID:1688
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"88⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock89⤵PID:2952
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"90⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock91⤵PID:672
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"92⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock93⤵PID:2356
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"94⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock95⤵PID:584
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"96⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock97⤵PID:2624
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"98⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock99⤵PID:1596
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"100⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock101⤵PID:2812
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"102⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock103⤵PID:2264
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"104⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock105⤵PID:2676
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"106⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock107⤵PID:2244
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"108⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock109⤵PID:1336
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"110⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock111⤵PID:1260
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"112⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock113⤵PID:1044
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"114⤵
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock115⤵PID:2188
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"116⤵
- System Location Discovery: System Language Discovery
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock117⤵PID:2040
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"118⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock119⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"120⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock121⤵PID:2720
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-08_7128fe39c0f51169acbbf8f33881b06b_virlock"122⤵PID:1348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-