Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2024 04:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe
-
Size
242KB
-
MD5
17d62c14f00cca5fbfdfac29cdbbcf5b
-
SHA1
cd53da64ffad95f3e8f024eb07a126ae8742b504
-
SHA256
e7fc2a1ff4d393351b8bee27b7f7a342e4871422ca14f23ca6caf9730929470f
-
SHA512
62ecb6b53759f61a476f06e48dbe97c5c353532c2c72621d7a8e8d143f92f984d911c0131a440add14d4d9e910987f95a0254c346e42dc92ded513f6f422b671
-
SSDEEP
6144:wJq2iHYGmU+fkPxqWNLPo3yrEnpMTx0J/KcBlY5EE4Trzg22U:rHkU+sPxqWNL1oJRW4zgv
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation AKUwMUUs.exe -
Executes dropped EXE 2 IoCs
pid Process 2736 AKUwMUUs.exe 4692 bcwQUEwI.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AKUwMUUs.exe = "C:\\Users\\Admin\\BgQMUgIg\\AKUwMUUs.exe" 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bcwQUEwI.exe = "C:\\ProgramData\\DSYIUAMk\\bcwQUEwI.exe" 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AKUwMUUs.exe = "C:\\Users\\Admin\\BgQMUgIg\\AKUwMUUs.exe" AKUwMUUs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bcwQUEwI.exe = "C:\\ProgramData\\DSYIUAMk\\bcwQUEwI.exe" bcwQUEwI.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe AKUwMUUs.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe AKUwMUUs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 4364 reg.exe 2160 reg.exe 1184 reg.exe 1308 reg.exe 4208 reg.exe 3144 reg.exe 3968 reg.exe 692 reg.exe 4444 reg.exe 4340 reg.exe 3792 reg.exe 5116 reg.exe 2992 reg.exe 1020 reg.exe 3948 reg.exe 1932 reg.exe 2252 reg.exe 3868 reg.exe 4604 reg.exe 4456 reg.exe 3696 reg.exe 900 reg.exe 4824 reg.exe 456 reg.exe 4324 reg.exe 2224 reg.exe 368 reg.exe 2296 reg.exe 1152 reg.exe 4920 reg.exe 4324 reg.exe 2452 reg.exe 4084 reg.exe 3144 reg.exe 336 reg.exe 2712 reg.exe 1956 reg.exe 4336 reg.exe 2264 reg.exe 4544 reg.exe 4180 reg.exe 2616 reg.exe 2248 reg.exe 4100 reg.exe 2356 reg.exe 2608 reg.exe 1416 reg.exe 2908 reg.exe 4020 reg.exe 2900 reg.exe 2336 reg.exe 4848 reg.exe 3152 reg.exe 4604 reg.exe 4936 reg.exe 4660 reg.exe 4864 reg.exe 2160 reg.exe 1308 reg.exe 2872 reg.exe 2744 reg.exe 3576 reg.exe 3408 reg.exe 3084 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3256 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3256 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3256 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3256 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4720 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4720 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4720 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4720 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 2568 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 2568 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 2568 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 2568 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4924 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4924 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4924 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4924 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3096 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3096 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3096 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3096 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 5116 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 5116 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 5116 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 5116 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 32 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 32 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 32 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 32 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4188 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4188 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4188 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4188 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3448 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3448 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3448 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 3448 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 2412 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 2412 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 2412 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 2412 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 5116 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 5116 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 5116 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 5116 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4340 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4340 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4340 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 4340 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 796 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 796 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 796 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 796 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2736 AKUwMUUs.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe 2736 AKUwMUUs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 624 wrote to memory of 2736 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 85 PID 624 wrote to memory of 2736 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 85 PID 624 wrote to memory of 2736 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 85 PID 624 wrote to memory of 4692 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 86 PID 624 wrote to memory of 4692 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 86 PID 624 wrote to memory of 4692 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 86 PID 624 wrote to memory of 4940 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 87 PID 624 wrote to memory of 4940 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 87 PID 624 wrote to memory of 4940 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 87 PID 624 wrote to memory of 3908 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 89 PID 624 wrote to memory of 3908 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 89 PID 624 wrote to memory of 3908 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 89 PID 4940 wrote to memory of 4700 4940 cmd.exe 91 PID 4940 wrote to memory of 4700 4940 cmd.exe 91 PID 4940 wrote to memory of 4700 4940 cmd.exe 91 PID 624 wrote to memory of 4336 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 90 PID 624 wrote to memory of 4336 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 90 PID 624 wrote to memory of 4336 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 90 PID 624 wrote to memory of 2408 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 92 PID 624 wrote to memory of 2408 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 92 PID 624 wrote to memory of 2408 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 92 PID 624 wrote to memory of 4232 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 93 PID 624 wrote to memory of 4232 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 93 PID 624 wrote to memory of 4232 624 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 93 PID 4232 wrote to memory of 4848 4232 cmd.exe 98 PID 4232 wrote to memory of 4848 4232 cmd.exe 98 PID 4232 wrote to memory of 4848 4232 cmd.exe 98 PID 4700 wrote to memory of 228 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 100 PID 4700 wrote to memory of 228 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 100 PID 4700 wrote to memory of 228 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 100 PID 228 wrote to memory of 1416 228 cmd.exe 102 PID 228 wrote to memory of 1416 228 cmd.exe 102 PID 228 wrote to memory of 1416 228 cmd.exe 102 PID 4700 wrote to memory of 3948 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 103 PID 4700 wrote to memory of 3948 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 103 PID 4700 wrote to memory of 3948 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 103 PID 4700 wrote to memory of 1868 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 104 PID 4700 wrote to memory of 1868 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 104 PID 4700 wrote to memory of 1868 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 104 PID 4700 wrote to memory of 4724 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 105 PID 4700 wrote to memory of 4724 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 105 PID 4700 wrote to memory of 4724 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 105 PID 4700 wrote to memory of 2264 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 106 PID 4700 wrote to memory of 2264 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 106 PID 4700 wrote to memory of 2264 4700 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 106 PID 2264 wrote to memory of 2080 2264 cmd.exe 111 PID 2264 wrote to memory of 2080 2264 cmd.exe 111 PID 2264 wrote to memory of 2080 2264 cmd.exe 111 PID 1416 wrote to memory of 1780 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 112 PID 1416 wrote to memory of 1780 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 112 PID 1416 wrote to memory of 1780 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 112 PID 1416 wrote to memory of 4772 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 114 PID 1416 wrote to memory of 4772 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 114 PID 1416 wrote to memory of 4772 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 114 PID 1416 wrote to memory of 3656 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 115 PID 1416 wrote to memory of 3656 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 115 PID 1416 wrote to memory of 3656 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 115 PID 1416 wrote to memory of 908 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 116 PID 1416 wrote to memory of 908 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 116 PID 1416 wrote to memory of 908 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 116 PID 1416 wrote to memory of 2148 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 117 PID 1416 wrote to memory of 2148 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 117 PID 1416 wrote to memory of 2148 1416 2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe 117 PID 1780 wrote to memory of 3256 1780 cmd.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\BgQMUgIg\AKUwMUUs.exe"C:\Users\Admin\BgQMUgIg\AKUwMUUs.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2736
-
-
C:\ProgramData\DSYIUAMk\bcwQUEwI.exe"C:\ProgramData\DSYIUAMk\bcwQUEwI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"8⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"10⤵
- System Location Discovery: System Language Discovery
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"12⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"14⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:3096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"16⤵
- System Location Discovery: System Language Discovery
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"18⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:32 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"20⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"22⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"24⤵PID:2940
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵PID:1400
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"26⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"28⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock29⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"30⤵PID:3368
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵PID:3696
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"32⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock33⤵PID:3120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"34⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock35⤵PID:1184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"36⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock37⤵PID:4992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"38⤵
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock39⤵PID:1872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"40⤵
- System Location Discovery: System Language Discovery
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock41⤵PID:1748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"42⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock43⤵
- System Location Discovery: System Language Discovery
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"44⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock45⤵PID:1152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"46⤵PID:4324
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵PID:4660
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock47⤵PID:4208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"48⤵PID:1676
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵PID:4864
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock49⤵PID:4328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"50⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock51⤵PID:4788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"52⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock53⤵PID:3956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"54⤵PID:4336
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock55⤵PID:2712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"56⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock57⤵PID:2400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"58⤵PID:1996
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵PID:1308
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock59⤵PID:3740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"60⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock61⤵PID:2616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"62⤵PID:4556
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵PID:4932
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock63⤵PID:4484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"64⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock65⤵PID:1140
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"66⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock67⤵PID:4044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"68⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock69⤵PID:2404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"70⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock71⤵PID:1200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"72⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock73⤵PID:3096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"74⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock75⤵PID:1872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"76⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock77⤵PID:4992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"78⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock79⤵PID:4996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"80⤵PID:4504
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:4336
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock81⤵PID:1836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"82⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock83⤵PID:5004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"84⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock85⤵PID:2148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"86⤵
- System Location Discovery: System Language Discovery
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock87⤵PID:4604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"88⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock89⤵PID:3644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"90⤵
- System Location Discovery: System Language Discovery
PID:4924 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵PID:2224
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock91⤵
- System Location Discovery: System Language Discovery
PID:456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"92⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock93⤵PID:3844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"94⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock95⤵PID:2348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"96⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock97⤵PID:3712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"98⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock99⤵PID:2300
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"100⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock101⤵PID:4512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"102⤵PID:1256
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵PID:2608
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock103⤵PID:1604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"104⤵
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock105⤵PID:3864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"106⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock107⤵PID:1416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"108⤵PID:5116
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:1636
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock109⤵PID:5080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"110⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock111⤵PID:2408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"112⤵
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵PID:5060
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock113⤵PID:4540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"114⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock115⤵PID:1780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"116⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock117⤵PID:5056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"118⤵PID:3120
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵PID:1200
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock119⤵
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"120⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock121⤵PID:2004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-10-26_17d62c14f00cca5fbfdfac29cdbbcf5b_virlock"122⤵PID:4276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-