Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 17:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe
-
Size
121KB
-
MD5
3c1c337d67b3742f5e15720fc2944065
-
SHA1
79638c024556a9fe9ebc8aa98e13077d0919a70e
-
SHA256
2decc0f00c6c2cf12f558ac9d0d2282124e2c99e1ecc6cb67a2cb22dea5a02f9
-
SHA512
fc319a9a9ac8bad2e47e7cc9f3c84b0ea7b42f46b6bf6698fe05b207c8483fcd645e96a9afeb065c89712c24b26af34e6770849300f9530a1a6c6f8313095d08
-
SSDEEP
1536:KDhCmsmNqtuwrCCUP8Tw+s0kzKWy5cuUJEYcYbCUWDqIMlDQMis+l1zx1xX4U:qhLs4Hw68TOxJEYcYeUWDqJlDSxX4U
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\International\Geo\Nation MwIMccAE.exe -
Executes dropped EXE 2 IoCs
pid Process 2352 MwIMccAE.exe 2300 yIAkEYMg.exe -
Loads dropped DLL 20 IoCs
pid Process 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yIAkEYMg.exe = "C:\\ProgramData\\guMoIwYM\\yIAkEYMg.exe" yIAkEYMg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MwIMccAE.exe = "C:\\Users\\Admin\\ZEAsUwUg\\MwIMccAE.exe" 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yIAkEYMg.exe = "C:\\ProgramData\\guMoIwYM\\yIAkEYMg.exe" 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MwIMccAE.exe = "C:\\Users\\Admin\\ZEAsUwUg\\MwIMccAE.exe" MwIMccAE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 1928 reg.exe 1916 reg.exe 2032 reg.exe 2952 reg.exe 1216 reg.exe 916 reg.exe 1124 reg.exe 2056 reg.exe 2496 reg.exe 1264 reg.exe 2696 reg.exe 1440 reg.exe 2360 reg.exe 2788 reg.exe 2740 reg.exe 376 reg.exe 1124 reg.exe 2888 reg.exe 2956 reg.exe 2880 reg.exe 2988 reg.exe 2000 reg.exe 2216 reg.exe 2604 reg.exe 292 reg.exe 1544 reg.exe 2152 reg.exe 1892 reg.exe 2308 reg.exe 1528 reg.exe 2488 reg.exe 2016 reg.exe 2736 reg.exe 2556 reg.exe 2212 reg.exe 1008 reg.exe 2144 reg.exe 1732 reg.exe 1252 reg.exe 1432 reg.exe 2952 reg.exe 2220 reg.exe 804 reg.exe 3024 reg.exe 752 reg.exe 2312 reg.exe 2096 reg.exe 1972 reg.exe 2536 reg.exe 1052 reg.exe 1956 reg.exe 2536 reg.exe 3000 reg.exe 752 reg.exe 2992 reg.exe 376 reg.exe 2928 reg.exe 2148 reg.exe 316 reg.exe 2508 reg.exe 2320 reg.exe 2636 reg.exe 1992 reg.exe 2872 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2604 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2604 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2744 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2744 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2160 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2160 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2252 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2252 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1700 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1700 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2808 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2808 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 832 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 832 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2872 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2872 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2952 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2952 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 344 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 344 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1600 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1600 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2596 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2596 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2600 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2600 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2776 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2776 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 680 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 680 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1028 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1028 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2688 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2688 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2760 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2760 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1052 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1052 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 3052 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 3052 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2216 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2216 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1712 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1712 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1052 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1052 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2232 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2232 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2424 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2424 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1992 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1992 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1596 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1596 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1540 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 1540 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2648 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2648 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2684 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 2684 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2352 MwIMccAE.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe 2352 MwIMccAE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2352 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 31 PID 2412 wrote to memory of 2352 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 31 PID 2412 wrote to memory of 2352 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 31 PID 2412 wrote to memory of 2352 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 31 PID 2412 wrote to memory of 2300 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 32 PID 2412 wrote to memory of 2300 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 32 PID 2412 wrote to memory of 2300 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 32 PID 2412 wrote to memory of 2300 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 32 PID 2412 wrote to memory of 2480 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 33 PID 2412 wrote to memory of 2480 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 33 PID 2412 wrote to memory of 2480 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 33 PID 2412 wrote to memory of 2480 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 33 PID 2480 wrote to memory of 2640 2480 cmd.exe 35 PID 2480 wrote to memory of 2640 2480 cmd.exe 35 PID 2480 wrote to memory of 2640 2480 cmd.exe 35 PID 2480 wrote to memory of 2640 2480 cmd.exe 35 PID 2412 wrote to memory of 1992 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 36 PID 2412 wrote to memory of 1992 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 36 PID 2412 wrote to memory of 1992 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 36 PID 2412 wrote to memory of 1992 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 36 PID 2412 wrote to memory of 2816 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 37 PID 2412 wrote to memory of 2816 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 37 PID 2412 wrote to memory of 2816 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 37 PID 2412 wrote to memory of 2816 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 37 PID 2412 wrote to memory of 2848 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 39 PID 2412 wrote to memory of 2848 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 39 PID 2412 wrote to memory of 2848 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 39 PID 2412 wrote to memory of 2848 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 39 PID 2412 wrote to memory of 2884 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 42 PID 2412 wrote to memory of 2884 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 42 PID 2412 wrote to memory of 2884 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 42 PID 2412 wrote to memory of 2884 2412 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 42 PID 2884 wrote to memory of 2936 2884 cmd.exe 44 PID 2884 wrote to memory of 2936 2884 cmd.exe 44 PID 2884 wrote to memory of 2936 2884 cmd.exe 44 PID 2884 wrote to memory of 2936 2884 cmd.exe 44 PID 2640 wrote to memory of 2560 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 45 PID 2640 wrote to memory of 2560 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 45 PID 2640 wrote to memory of 2560 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 45 PID 2640 wrote to memory of 2560 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 45 PID 2560 wrote to memory of 2604 2560 cmd.exe 47 PID 2560 wrote to memory of 2604 2560 cmd.exe 47 PID 2560 wrote to memory of 2604 2560 cmd.exe 47 PID 2560 wrote to memory of 2604 2560 cmd.exe 47 PID 2640 wrote to memory of 2580 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 48 PID 2640 wrote to memory of 2580 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 48 PID 2640 wrote to memory of 2580 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 48 PID 2640 wrote to memory of 2580 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 48 PID 2640 wrote to memory of 2148 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 49 PID 2640 wrote to memory of 2148 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 49 PID 2640 wrote to memory of 2148 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 49 PID 2640 wrote to memory of 2148 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 49 PID 2640 wrote to memory of 2104 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 51 PID 2640 wrote to memory of 2104 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 51 PID 2640 wrote to memory of 2104 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 51 PID 2640 wrote to memory of 2104 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 51 PID 2640 wrote to memory of 2272 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 53 PID 2640 wrote to memory of 2272 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 53 PID 2640 wrote to memory of 2272 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 53 PID 2640 wrote to memory of 2272 2640 2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe 53 PID 2272 wrote to memory of 1860 2272 cmd.exe 56 PID 2272 wrote to memory of 1860 2272 cmd.exe 56 PID 2272 wrote to memory of 1860 2272 cmd.exe 56 PID 2272 wrote to memory of 1860 2272 cmd.exe 56
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\ZEAsUwUg\MwIMccAE.exe"C:\Users\Admin\ZEAsUwUg\MwIMccAE.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2352
-
-
C:\ProgramData\guMoIwYM\yIAkEYMg.exe"C:\ProgramData\guMoIwYM\yIAkEYMg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2300
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2604 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"6⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2744 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"8⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"10⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2252 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"12⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"14⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2808 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"16⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:832 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"18⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock19⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2872 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"20⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2952 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"22⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:344 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"24⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1600 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"26⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"28⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2600 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"30⤵
- System Location Discovery: System Language Discovery
PID:832 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2776 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"32⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock33⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:680 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"34⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1028 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"36⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:2688 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"38⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2760 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"40⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"42⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:3052 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"44⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2216 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"46⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:1712 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"48⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"50⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"52⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2424 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"54⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"56⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1596 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"58⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:1540 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"60⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2648 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"62⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2684 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"64⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock65⤵
- System Location Discovery: System Language Discovery
PID:108 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"66⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock67⤵PID:2316
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"68⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock69⤵PID:2148
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"70⤵
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock71⤵PID:1856
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"72⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock73⤵PID:2252
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"74⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock75⤵PID:2204
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"76⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock77⤵PID:3028
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"78⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock79⤵PID:1528
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"80⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock81⤵PID:1396
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"82⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock83⤵PID:2016
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"84⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock85⤵PID:1296
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"86⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock87⤵PID:2676
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"88⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock89⤵PID:1932
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"90⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock91⤵PID:2140
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"92⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock93⤵PID:2152
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"94⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock95⤵PID:2336
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"96⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock97⤵PID:2528
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"98⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock99⤵PID:1892
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"100⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock101⤵PID:2288
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"102⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock103⤵PID:348
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"104⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock105⤵
- System Location Discovery: System Language Discovery
PID:1560 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"106⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock107⤵PID:1984
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"108⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock109⤵PID:2832
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"110⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock111⤵PID:2324
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"112⤵
- System Location Discovery: System Language Discovery
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock113⤵PID:2580
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"114⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock115⤵
- System Location Discovery: System Language Discovery
PID:2080 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"116⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock117⤵PID:2676
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"118⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock119⤵PID:1816
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"120⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock121⤵PID:1532
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-16_3c1c337d67b3742f5e15720fc2944065_virlock"122⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-