Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 17:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe
-
Size
121KB
-
MD5
3c1c337d67b3742f5e15720fc2944065
-
SHA1
79638c024556a9fe9ebc8aa98e13077d0919a70e
-
SHA256
2decc0f00c6c2cf12f558ac9d0d2282124e2c99e1ecc6cb67a2cb22dea5a02f9
-
SHA512
fc319a9a9ac8bad2e47e7cc9f3c84b0ea7b42f46b6bf6698fe05b207c8483fcd645e96a9afeb065c89712c24b26af34e6770849300f9530a1a6c6f8313095d08
-
SSDEEP
1536:KDhCmsmNqtuwrCCUP8Tw+s0kzKWy5cuUJEYcYbCUWDqIMlDQMis+l1zx1xX4U:qhLs4Hw68TOxJEYcYeUWDqJlDSxX4U
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\International\Geo\Nation AEEowoEM.exe -
Executes dropped EXE 2 IoCs
pid Process 1636 WuowwEIY.exe 2256 AEEowoEM.exe -
Loads dropped DLL 20 IoCs
pid Process 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AEEowoEM.exe = "C:\\ProgramData\\AIIcIogU\\AEEowoEM.exe" 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AEEowoEM.exe = "C:\\ProgramData\\AIIcIogU\\AEEowoEM.exe" AEEowoEM.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\WuowwEIY.exe = "C:\\Users\\Admin\\sogAYUcU\\WuowwEIY.exe" WuowwEIY.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\WuowwEIY.exe = "C:\\Users\\Admin\\sogAYUcU\\WuowwEIY.exe" 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2488 reg.exe 324 reg.exe 876 reg.exe 2524 reg.exe 2792 reg.exe 1548 reg.exe 1436 reg.exe 1888 reg.exe 2144 reg.exe 2136 reg.exe 444 reg.exe 2820 reg.exe 2072 reg.exe 2180 reg.exe 2124 reg.exe 628 reg.exe 2516 reg.exe 1436 reg.exe 2524 reg.exe 2040 reg.exe 2760 reg.exe 1844 reg.exe 752 reg.exe 2676 reg.exe 2040 reg.exe 2668 reg.exe 2572 reg.exe 2496 reg.exe 2516 reg.exe 344 reg.exe 2588 reg.exe 1720 reg.exe 392 reg.exe 1672 reg.exe 284 reg.exe 1700 reg.exe 2432 reg.exe 2224 reg.exe 2308 reg.exe 2896 reg.exe 2380 reg.exe 2568 reg.exe 2488 reg.exe 2576 reg.exe 2744 reg.exe 2936 reg.exe 1840 reg.exe 2676 reg.exe 1704 reg.exe 2404 reg.exe 1548 reg.exe 2828 reg.exe 2792 reg.exe 1996 reg.exe 2320 reg.exe 2692 reg.exe 2624 reg.exe 2568 reg.exe 2852 reg.exe 3008 reg.exe 2984 reg.exe 2724 reg.exe 2656 reg.exe 2264 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1096 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1096 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 896 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 896 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2912 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2912 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1832 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1832 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1692 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1692 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2572 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2572 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2772 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2772 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2992 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2992 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 596 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 596 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 776 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 776 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1544 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1544 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2088 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2088 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1044 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1044 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1612 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1612 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2076 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2076 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 876 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 876 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2432 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2432 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1784 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1784 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1516 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1516 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2360 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2360 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2964 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2964 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2908 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2908 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2752 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2752 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2996 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2996 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1740 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1740 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2684 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2684 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 580 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 580 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2212 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2212 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2812 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2812 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2256 AEEowoEM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe 2256 AEEowoEM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1636 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 30 PID 1476 wrote to memory of 1636 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 30 PID 1476 wrote to memory of 1636 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 30 PID 1476 wrote to memory of 1636 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 30 PID 1476 wrote to memory of 2256 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 31 PID 1476 wrote to memory of 2256 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 31 PID 1476 wrote to memory of 2256 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 31 PID 1476 wrote to memory of 2256 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 31 PID 1476 wrote to memory of 2624 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 32 PID 1476 wrote to memory of 2624 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 32 PID 1476 wrote to memory of 2624 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 32 PID 1476 wrote to memory of 2624 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 32 PID 2624 wrote to memory of 2804 2624 cmd.exe 34 PID 2624 wrote to memory of 2804 2624 cmd.exe 34 PID 2624 wrote to memory of 2804 2624 cmd.exe 34 PID 2624 wrote to memory of 2804 2624 cmd.exe 34 PID 1476 wrote to memory of 2524 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 35 PID 1476 wrote to memory of 2524 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 35 PID 1476 wrote to memory of 2524 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 35 PID 1476 wrote to memory of 2524 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 35 PID 1476 wrote to memory of 2252 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 36 PID 1476 wrote to memory of 2252 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 36 PID 1476 wrote to memory of 2252 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 36 PID 1476 wrote to memory of 2252 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 36 PID 1476 wrote to memory of 2680 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 38 PID 1476 wrote to memory of 2680 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 38 PID 1476 wrote to memory of 2680 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 38 PID 1476 wrote to memory of 2680 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 38 PID 1476 wrote to memory of 2684 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 41 PID 1476 wrote to memory of 2684 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 41 PID 1476 wrote to memory of 2684 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 41 PID 1476 wrote to memory of 2684 1476 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 41 PID 2684 wrote to memory of 2568 2684 cmd.exe 43 PID 2684 wrote to memory of 2568 2684 cmd.exe 43 PID 2684 wrote to memory of 2568 2684 cmd.exe 43 PID 2684 wrote to memory of 2568 2684 cmd.exe 43 PID 2804 wrote to memory of 2756 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 44 PID 2804 wrote to memory of 2756 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 44 PID 2804 wrote to memory of 2756 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 44 PID 2804 wrote to memory of 2756 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 44 PID 2756 wrote to memory of 1096 2756 cmd.exe 46 PID 2756 wrote to memory of 1096 2756 cmd.exe 46 PID 2756 wrote to memory of 1096 2756 cmd.exe 46 PID 2756 wrote to memory of 1096 2756 cmd.exe 46 PID 2804 wrote to memory of 1968 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 47 PID 2804 wrote to memory of 1968 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 47 PID 2804 wrote to memory of 1968 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 47 PID 2804 wrote to memory of 1968 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 47 PID 2804 wrote to memory of 2792 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 48 PID 2804 wrote to memory of 2792 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 48 PID 2804 wrote to memory of 2792 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 48 PID 2804 wrote to memory of 2792 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 48 PID 2804 wrote to memory of 2268 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 50 PID 2804 wrote to memory of 2268 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 50 PID 2804 wrote to memory of 2268 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 50 PID 2804 wrote to memory of 2268 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 50 PID 2804 wrote to memory of 2760 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 51 PID 2804 wrote to memory of 2760 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 51 PID 2804 wrote to memory of 2760 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 51 PID 2804 wrote to memory of 2760 2804 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 51 PID 2760 wrote to memory of 1192 2760 cmd.exe 55 PID 2760 wrote to memory of 1192 2760 cmd.exe 55 PID 2760 wrote to memory of 1192 2760 cmd.exe 55 PID 2760 wrote to memory of 1192 2760 cmd.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\sogAYUcU\WuowwEIY.exe"C:\Users\Admin\sogAYUcU\WuowwEIY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1636
-
-
C:\ProgramData\AIIcIogU\AEEowoEM.exe"C:\ProgramData\AIIcIogU\AEEowoEM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2256
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1096 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"6⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:896 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"8⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2912 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"10⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1832 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"12⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"14⤵
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"16⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"18⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"20⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:596 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"22⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:776 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"24⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1544 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"26⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2088 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"28⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:1044 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"30⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"32⤵
- System Location Discovery: System Language Discovery
PID:684 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2076 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"34⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock35⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:876 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"36⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"38⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:1784 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"40⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock41⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2412 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"42⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"44⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2360 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"46⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock47⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2964 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"48⤵
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock49⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2908 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"50⤵
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"52⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2996 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"54⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"56⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock57⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2684 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"58⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:580 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"60⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2212 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"62⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"64⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock65⤵
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"66⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock67⤵
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"68⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock69⤵PID:896
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"70⤵
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock71⤵PID:2860
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"72⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock73⤵PID:2676
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"74⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock75⤵PID:2844
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"76⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock77⤵PID:2612
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"78⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock79⤵PID:2776
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"80⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock81⤵PID:1148
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"82⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock83⤵PID:2488
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"84⤵
- System Location Discovery: System Language Discovery
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock85⤵PID:1732
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"86⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock87⤵PID:2872
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"88⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock89⤵PID:736
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"90⤵
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock91⤵PID:2552
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"92⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock93⤵PID:2864
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"94⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock95⤵PID:1764
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"96⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock97⤵
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"98⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock99⤵PID:352
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"100⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock101⤵PID:2100
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"102⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock103⤵PID:2196
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"104⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock105⤵PID:2748
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"106⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock107⤵PID:1504
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"108⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock109⤵PID:752
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"110⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock111⤵
- System Location Discovery: System Language Discovery
PID:340 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"112⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock113⤵PID:352
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"114⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock115⤵PID:1592
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"116⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock117⤵
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"118⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock119⤵PID:2780
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"120⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock121⤵PID:2484
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"122⤵PID:1096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-