Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 01:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe
-
Size
225KB
-
MD5
81ab65298a81d207d0561795301cbc83
-
SHA1
92c2684af4919c83ad829c4597b8b7e6117a84bf
-
SHA256
9e5b495ca615441e41664c15de272de18ba033eb1285f9b374fa28e90e1df353
-
SHA512
a942fa9f6077459c9c09e1c9cf09945e0c2ae553069e52d88eea2ab0e7cc9dd933164900a2d0575b17b0460893b3d41f441ca7d45288343fd3c621df91099db3
-
SSDEEP
3072:Z+HY0gDpQFkUXBiSLAuHWIEHOOt3riP890j/mW8JrbEGTSxqEBxyP:4Hj0pQjpWDJ/EGTSIEBxyP
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (59) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\International\Geo\Nation HmgQQcMU.exe -
Executes dropped EXE 2 IoCs
pid Process 2968 HmgQQcMU.exe 2648 sUUIsoUw.exe -
Loads dropped DLL 20 IoCs
pid Process 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sUUIsoUw.exe = "C:\\ProgramData\\kqoQkIMM\\sUUIsoUw.exe" 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\HmgQQcMU.exe = "C:\\Users\\Admin\\OYQogEkM\\HmgQQcMU.exe" HmgQQcMU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sUUIsoUw.exe = "C:\\ProgramData\\kqoQkIMM\\sUUIsoUw.exe" sUUIsoUw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\HmgQQcMU.exe = "C:\\Users\\Admin\\OYQogEkM\\HmgQQcMU.exe" 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico HmgQQcMU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HmgQQcMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2780 reg.exe 1944 reg.exe 2004 reg.exe 1672 reg.exe 1220 reg.exe 2012 reg.exe 1452 reg.exe 852 reg.exe 1568 reg.exe 1524 reg.exe 2868 reg.exe 444 reg.exe 1456 reg.exe 2508 reg.exe 688 reg.exe 2688 reg.exe 1940 reg.exe 2112 reg.exe 2628 reg.exe 2596 reg.exe 2760 reg.exe 2068 reg.exe 2900 reg.exe 2264 reg.exe 2820 reg.exe 1620 reg.exe 676 reg.exe 1432 reg.exe 2764 reg.exe 2872 reg.exe 1932 reg.exe 1900 reg.exe 2452 reg.exe 932 reg.exe 1940 reg.exe 3012 reg.exe 2784 reg.exe 1732 reg.exe 1196 reg.exe 1468 reg.exe 1384 reg.exe 628 reg.exe 1420 reg.exe 1580 reg.exe 1588 reg.exe 2572 reg.exe 2964 reg.exe 2252 reg.exe 1756 reg.exe 1380 reg.exe 2436 reg.exe 1944 reg.exe 888 reg.exe 3020 reg.exe 1660 reg.exe 2688 reg.exe 2872 reg.exe 1728 reg.exe 2284 reg.exe 1888 reg.exe 888 reg.exe 468 reg.exe 1764 reg.exe 2580 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2888 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2888 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1752 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1752 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1088 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1088 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 276 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 276 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1684 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1684 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 332 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 332 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2620 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2620 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2976 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2976 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1692 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1692 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1956 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1956 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2572 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2572 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3064 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3064 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2392 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2392 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2208 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2208 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1140 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1140 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 572 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 572 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2748 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2748 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2620 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2620 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2192 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2192 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1316 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1316 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2588 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2588 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3012 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3012 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2292 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2292 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1864 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1864 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2216 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2216 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1720 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1720 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1004 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1004 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3064 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3064 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2968 HmgQQcMU.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe 2968 HmgQQcMU.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2968 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 30 PID 2736 wrote to memory of 2968 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 30 PID 2736 wrote to memory of 2968 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 30 PID 2736 wrote to memory of 2968 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 30 PID 2736 wrote to memory of 2648 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 31 PID 2736 wrote to memory of 2648 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 31 PID 2736 wrote to memory of 2648 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 31 PID 2736 wrote to memory of 2648 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 31 PID 2736 wrote to memory of 2584 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 32 PID 2736 wrote to memory of 2584 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 32 PID 2736 wrote to memory of 2584 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 32 PID 2736 wrote to memory of 2584 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 32 PID 2736 wrote to memory of 2544 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 34 PID 2736 wrote to memory of 2544 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 34 PID 2736 wrote to memory of 2544 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 34 PID 2736 wrote to memory of 2544 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 34 PID 2736 wrote to memory of 2572 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 35 PID 2736 wrote to memory of 2572 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 35 PID 2736 wrote to memory of 2572 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 35 PID 2736 wrote to memory of 2572 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 35 PID 2736 wrote to memory of 2580 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 36 PID 2736 wrote to memory of 2580 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 36 PID 2736 wrote to memory of 2580 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 36 PID 2736 wrote to memory of 2580 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 36 PID 2736 wrote to memory of 1952 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 38 PID 2736 wrote to memory of 1952 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 38 PID 2736 wrote to memory of 1952 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 38 PID 2736 wrote to memory of 1952 2736 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 38 PID 2584 wrote to memory of 2700 2584 cmd.exe 39 PID 2584 wrote to memory of 2700 2584 cmd.exe 39 PID 2584 wrote to memory of 2700 2584 cmd.exe 39 PID 2584 wrote to memory of 2700 2584 cmd.exe 39 PID 1952 wrote to memory of 1136 1952 cmd.exe 43 PID 1952 wrote to memory of 1136 1952 cmd.exe 43 PID 1952 wrote to memory of 1136 1952 cmd.exe 43 PID 1952 wrote to memory of 1136 1952 cmd.exe 43 PID 2700 wrote to memory of 2304 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 44 PID 2700 wrote to memory of 2304 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 44 PID 2700 wrote to memory of 2304 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 44 PID 2700 wrote to memory of 2304 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 44 PID 2304 wrote to memory of 2888 2304 cmd.exe 46 PID 2304 wrote to memory of 2888 2304 cmd.exe 46 PID 2304 wrote to memory of 2888 2304 cmd.exe 46 PID 2304 wrote to memory of 2888 2304 cmd.exe 46 PID 2700 wrote to memory of 2112 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 47 PID 2700 wrote to memory of 2112 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 47 PID 2700 wrote to memory of 2112 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 47 PID 2700 wrote to memory of 2112 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 47 PID 2700 wrote to memory of 1160 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 48 PID 2700 wrote to memory of 1160 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 48 PID 2700 wrote to memory of 1160 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 48 PID 2700 wrote to memory of 1160 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 48 PID 2700 wrote to memory of 1852 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 49 PID 2700 wrote to memory of 1852 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 49 PID 2700 wrote to memory of 1852 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 49 PID 2700 wrote to memory of 1852 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 49 PID 2700 wrote to memory of 2600 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 50 PID 2700 wrote to memory of 2600 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 50 PID 2700 wrote to memory of 2600 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 50 PID 2700 wrote to memory of 2600 2700 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 50 PID 2600 wrote to memory of 2864 2600 cmd.exe 55 PID 2600 wrote to memory of 2864 2600 cmd.exe 55 PID 2600 wrote to memory of 2864 2600 cmd.exe 55 PID 2600 wrote to memory of 2864 2600 cmd.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\OYQogEkM\HmgQQcMU.exe"C:\Users\Admin\OYQogEkM\HmgQQcMU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2968
-
-
C:\ProgramData\kqoQkIMM\sUUIsoUw.exe"C:\ProgramData\kqoQkIMM\sUUIsoUw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2648
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2888 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"6⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1752 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"8⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock9⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1088 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"10⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:276 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"12⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"14⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:332 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"16⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"18⤵
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"20⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"22⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1956 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"24⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"26⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3064 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"28⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock29⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1736 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"30⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2392 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"32⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2208 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"34⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"36⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:572 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"38⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"40⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"42⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock43⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2192 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"44⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"46⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:2588 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"48⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"50⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2292 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"52⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"54⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:2216 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"56⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1720 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"58⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:484 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"60⤵
- System Location Discovery: System Language Discovery
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:1004 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"62⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock63⤵
- Suspicious behavior: EnumeratesProcesses
PID:3064 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"64⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock65⤵PID:2508
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"66⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock67⤵
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"68⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock69⤵PID:2244
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"70⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock71⤵PID:1580
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"72⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock73⤵PID:2864
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"74⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock75⤵PID:2772
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"76⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock77⤵PID:2276
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"78⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock79⤵PID:2452
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"80⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock81⤵PID:1892
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"82⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock83⤵PID:2524
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"84⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock85⤵PID:2780
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"86⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock87⤵PID:1452
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"88⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock89⤵PID:2928
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"90⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock91⤵PID:2804
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"92⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock93⤵PID:1720
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"94⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock95⤵PID:2796
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"96⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock97⤵
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"98⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock99⤵PID:1860
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"100⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock101⤵PID:2416
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"102⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock103⤵PID:2644
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"104⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock105⤵PID:2872
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"106⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock107⤵PID:1268
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"108⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock109⤵PID:2576
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"110⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock111⤵PID:1932
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"112⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock113⤵PID:1692
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"114⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock115⤵PID:1380
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"116⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock117⤵PID:1664
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"118⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock119⤵PID:2068
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"120⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock121⤵PID:1872
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"122⤵PID:1704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-