Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2024 01:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe
-
Size
225KB
-
MD5
81ab65298a81d207d0561795301cbc83
-
SHA1
92c2684af4919c83ad829c4597b8b7e6117a84bf
-
SHA256
9e5b495ca615441e41664c15de272de18ba033eb1285f9b374fa28e90e1df353
-
SHA512
a942fa9f6077459c9c09e1c9cf09945e0c2ae553069e52d88eea2ab0e7cc9dd933164900a2d0575b17b0460893b3d41f441ca7d45288343fd3c621df91099db3
-
SSDEEP
3072:Z+HY0gDpQFkUXBiSLAuHWIEHOOt3riP890j/mW8JrbEGTSxqEBxyP:4Hj0pQjpWDJ/EGTSIEBxyP
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (88) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation SCkwYUks.exe -
Executes dropped EXE 2 IoCs
pid Process 4704 SCkwYUks.exe 4884 XuUAQkIE.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SCkwYUks.exe = "C:\\Users\\Admin\\lQwMsgog\\SCkwYUks.exe" 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XuUAQkIE.exe = "C:\\ProgramData\\vAYUwgkg\\XuUAQkIE.exe" 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SCkwYUks.exe = "C:\\Users\\Admin\\lQwMsgog\\SCkwYUks.exe" SCkwYUks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XuUAQkIE.exe = "C:\\ProgramData\\vAYUwgkg\\XuUAQkIE.exe" XuUAQkIE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 3092 reg.exe 4392 reg.exe 4464 reg.exe 2916 reg.exe 4948 reg.exe 3856 Process not Found 1772 Process not Found 3864 reg.exe 2912 reg.exe 4812 reg.exe 1264 reg.exe 2364 reg.exe 3596 reg.exe 4548 reg.exe 2988 reg.exe 2772 reg.exe 4044 reg.exe 4720 Process not Found 4528 Process not Found 3932 reg.exe 4644 reg.exe 4700 reg.exe 4948 reg.exe 2164 reg.exe 448 reg.exe 1992 reg.exe 2064 reg.exe 3256 reg.exe 3004 reg.exe 3468 reg.exe 868 reg.exe 2916 reg.exe 3256 reg.exe 3824 Process not Found 2560 reg.exe 4452 reg.exe 1340 reg.exe 3588 reg.exe 2436 reg.exe 4868 reg.exe 5008 reg.exe 3736 reg.exe 2440 reg.exe 4656 reg.exe 4524 Process not Found 3580 reg.exe 3724 reg.exe 3412 reg.exe 2544 reg.exe 1052 reg.exe 228 reg.exe 3016 reg.exe 3468 reg.exe 1708 Process not Found 5016 reg.exe 3580 reg.exe 4404 Process not Found 452 reg.exe 1116 reg.exe 5072 reg.exe 2920 reg.exe 1660 reg.exe 1736 reg.exe 1740 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2616 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2616 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2616 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2616 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4712 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4712 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4712 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4712 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4536 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4536 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4536 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4536 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4976 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4976 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4976 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4976 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1400 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1400 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1400 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1400 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1992 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1992 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1992 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 1992 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2436 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2436 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2436 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2436 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4908 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4908 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4908 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4908 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3464 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3464 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3464 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3464 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2832 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2832 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2832 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 2832 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3236 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3236 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3236 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 3236 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 512 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 512 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 512 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 512 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 4468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4704 SCkwYUks.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe 4704 SCkwYUks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4484 wrote to memory of 4704 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 85 PID 4484 wrote to memory of 4704 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 85 PID 4484 wrote to memory of 4704 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 85 PID 4484 wrote to memory of 4884 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 86 PID 4484 wrote to memory of 4884 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 86 PID 4484 wrote to memory of 4884 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 86 PID 4484 wrote to memory of 2316 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 87 PID 4484 wrote to memory of 2316 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 87 PID 4484 wrote to memory of 2316 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 87 PID 4484 wrote to memory of 1056 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 89 PID 4484 wrote to memory of 1056 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 89 PID 4484 wrote to memory of 1056 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 89 PID 4484 wrote to memory of 4824 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 90 PID 4484 wrote to memory of 4824 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 90 PID 4484 wrote to memory of 4824 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 90 PID 4484 wrote to memory of 2804 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 91 PID 4484 wrote to memory of 2804 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 91 PID 4484 wrote to memory of 2804 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 91 PID 4484 wrote to memory of 4996 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 92 PID 4484 wrote to memory of 4996 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 92 PID 4484 wrote to memory of 4996 4484 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 92 PID 2316 wrote to memory of 4432 2316 cmd.exe 97 PID 2316 wrote to memory of 4432 2316 cmd.exe 97 PID 2316 wrote to memory of 4432 2316 cmd.exe 97 PID 4996 wrote to memory of 4424 4996 cmd.exe 98 PID 4996 wrote to memory of 4424 4996 cmd.exe 98 PID 4996 wrote to memory of 4424 4996 cmd.exe 98 PID 4432 wrote to memory of 4788 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 99 PID 4432 wrote to memory of 4788 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 99 PID 4432 wrote to memory of 4788 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 99 PID 4432 wrote to memory of 3580 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 101 PID 4432 wrote to memory of 3580 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 101 PID 4432 wrote to memory of 3580 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 101 PID 4432 wrote to memory of 1468 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 102 PID 4432 wrote to memory of 1468 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 102 PID 4432 wrote to memory of 1468 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 102 PID 4432 wrote to memory of 688 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 103 PID 4432 wrote to memory of 688 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 103 PID 4432 wrote to memory of 688 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 103 PID 4432 wrote to memory of 1712 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 104 PID 4432 wrote to memory of 1712 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 104 PID 4432 wrote to memory of 1712 4432 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 104 PID 4788 wrote to memory of 3468 4788 cmd.exe 109 PID 4788 wrote to memory of 3468 4788 cmd.exe 109 PID 4788 wrote to memory of 3468 4788 cmd.exe 109 PID 1712 wrote to memory of 764 1712 cmd.exe 110 PID 1712 wrote to memory of 764 1712 cmd.exe 110 PID 1712 wrote to memory of 764 1712 cmd.exe 110 PID 3468 wrote to memory of 3604 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 111 PID 3468 wrote to memory of 3604 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 111 PID 3468 wrote to memory of 3604 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 111 PID 3468 wrote to memory of 3864 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 113 PID 3468 wrote to memory of 3864 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 113 PID 3468 wrote to memory of 3864 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 113 PID 3468 wrote to memory of 5072 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 114 PID 3468 wrote to memory of 5072 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 114 PID 3468 wrote to memory of 5072 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 114 PID 3468 wrote to memory of 3956 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 115 PID 3468 wrote to memory of 3956 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 115 PID 3468 wrote to memory of 3956 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 115 PID 3468 wrote to memory of 1060 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 116 PID 3468 wrote to memory of 1060 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 116 PID 3468 wrote to memory of 1060 3468 2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe 116 PID 3604 wrote to memory of 2616 3604 cmd.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\lQwMsgog\SCkwYUks.exe"C:\Users\Admin\lQwMsgog\SCkwYUks.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4704
-
-
C:\ProgramData\vAYUwgkg\XuUAQkIE.exe"C:\ProgramData\vAYUwgkg\XuUAQkIE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4884
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"8⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"10⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"12⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"14⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"16⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"18⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"20⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"22⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"24⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"26⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"28⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"30⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"32⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock33⤵PID:5016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"34⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock35⤵PID:4660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"36⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock37⤵PID:944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"38⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock39⤵PID:2804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"40⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock41⤵PID:1032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"42⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock43⤵
- System Location Discovery: System Language Discovery
PID:208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"44⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock45⤵PID:1688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"46⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock47⤵PID:4252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"48⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock49⤵PID:3896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"50⤵PID:4580
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵PID:1736
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock51⤵PID:2836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"52⤵
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock53⤵PID:4228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"54⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock55⤵PID:1592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"56⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock57⤵PID:4000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"58⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock59⤵PID:3856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"60⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock61⤵PID:3932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"62⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock63⤵PID:3000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"64⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock65⤵PID:860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"66⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock67⤵PID:2956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"68⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock69⤵PID:4024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"70⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock71⤵PID:4464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"72⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock73⤵PID:4288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"74⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock75⤵PID:1000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"76⤵PID:3296
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵PID:2192
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock77⤵PID:4316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"78⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock79⤵PID:3012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"80⤵PID:464
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:5028
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock81⤵PID:2828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"82⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock83⤵PID:4960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"84⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock85⤵PID:1932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"86⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock87⤵PID:5016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"88⤵
- System Location Discovery: System Language Discovery
PID:208 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:1116
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock89⤵PID:1852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"90⤵
- System Location Discovery: System Language Discovery
PID:812 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵PID:4024
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock91⤵PID:2480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"92⤵
- System Location Discovery: System Language Discovery
PID:764 -
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock93⤵PID:2912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"94⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock95⤵PID:3736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"96⤵PID:2840
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵PID:3000
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock97⤵PID:3368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"98⤵PID:1060
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:4260
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock99⤵PID:4040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"100⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock101⤵PID:3472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"102⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock103⤵PID:5032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"104⤵PID:3288
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵PID:4524
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock105⤵PID:1340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"106⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock107⤵PID:4720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"108⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock109⤵PID:3636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"110⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock111⤵PID:1520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"112⤵PID:3812
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵PID:640
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock113⤵PID:3872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"114⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock115⤵PID:4868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"116⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock117⤵PID:2364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"118⤵PID:1640
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵PID:4724
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock119⤵PID:2928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"120⤵PID:4324
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵PID:4960
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock121⤵PID:1068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-20_81ab65298a81d207d0561795301cbc83_virlock"122⤵PID:868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-