File name:

2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock

Full analysis: https://app.any.run/tasks/0e9de2de-d4e3-48c9-9f9a-e230da8a6979
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 00:24:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
virlock
ransomware
auto-reg
nsb
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 2 sections
MD5:

AF97A84EC18CC429E0273CFDE917BA6A

SHA1:

41B2998F1DAD9B2D7AD6FB6CB789B7B62B230A36

SHA256:

4881FD36D534E5B32CD49BB586C8423941322E5BBAA115DA5C7537AC1AFE08AB

SSDEEP:

6144:u0tgUMx/IEZxd6s42MUmjPxIWz2j/697qxafHW:jgB6s42M3IWyjC92xae

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1324)
      • SwoYcckM.exe (PID: 5892)
      • XWAQAQUE.exe (PID: 5728)
      • SwoYcckM.exe (PID: 7920)
      • XWAQAQUE.exe (PID: 7892)

    • VIRLOCK mutex has been found

      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1324)
      • SwoYcckM.exe (PID: 5892)
      • XWAQAQUE.exe (PID: 5728)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 5244)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 4268)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1272)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 7424)
      • XWAQAQUE.exe (PID: 7892)
      • SwoYcckM.exe (PID: 7920)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • cscript.exe (PID: 5124)
      • cscript.exe (PID: 7280)
      • cscript.exe (PID: 5380)
      • cscript.exe (PID: 7640)

    • Connects to the CnC server

      • XWAQAQUE.exe (PID: 5728)
      • SwoYcckM.exe (PID: 5892)
      • XWAQAQUE.exe (PID: 7892)
      • SwoYcckM.exe (PID: 7920)

    • NSB has been detected (SURICATA)

      • SwoYcckM.exe (PID: 5892)
      • XWAQAQUE.exe (PID: 7892)
      • SwoYcckM.exe (PID: 7920)
      • XWAQAQUE.exe (PID: 5728)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1324)
      • XWAQAQUE.exe (PID: 5728)

    • Starts CMD.EXE for commands execution

      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1324)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 5244)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 4268)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1272)

    • Executing commands from a ".bat" file

      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1324)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 5244)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 4268)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1272)

    • Uses REG/REGEDIT.EXE to modify registry

      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1324)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 5244)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 4268)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1272)
      • messagestatistics.jpg.exe (PID: 8024)
      • sonylots.png.exe (PID: 5280)
      • xmlnext.jpg.exe (PID: 4996)
      • votefi.png.exe (PID: 7640)
      • topicloans.jpg.exe (PID: 1388)

    • The process executes VB scripts

      • cmd.exe (PID: 4944)
      • cmd.exe (PID: 5112)
      • cmd.exe (PID: 1116)
      • cmd.exe (PID: 7488)

    • Connects to unusual port

      • XWAQAQUE.exe (PID: 7892)
      • SwoYcckM.exe (PID: 5892)
      • SwoYcckM.exe (PID: 7920)
      • XWAQAQUE.exe (PID: 5728)

  • INFO

    • Checks supported languages

      • XWAQAQUE.exe (PID: 5728)
      • SwoYcckM.exe (PID: 5892)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1324)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 5244)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 4268)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1272)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 7424)
      • XWAQAQUE.exe (PID: 7892)
      • SwoYcckM.exe (PID: 7920)

    • Create files in a temporary directory

      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1324)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 5244)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 4268)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1272)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 7424)

    • Reads the computer name

      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1324)
      • XWAQAQUE.exe (PID: 5728)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 5244)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 4268)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1272)
      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 7424)
      • XWAQAQUE.exe (PID: 7892)
      • SwoYcckM.exe (PID: 7920)
      • SwoYcckM.exe (PID: 5892)

    • Auto-launch of the file from Registry key

      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1324)
      • XWAQAQUE.exe (PID: 5728)
      • SwoYcckM.exe (PID: 5892)
      • XWAQAQUE.exe (PID: 7892)
      • SwoYcckM.exe (PID: 7920)

    • Creates files in the program directory

      • 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe (PID: 1324)
      • XWAQAQUE.exe (PID: 5728)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 5124)
      • cscript.exe (PID: 5380)
      • cscript.exe (PID: 7280)
      • cscript.exe (PID: 7640)

    • Manual execution by a user

      • SwoYcckM.exe (PID: 7920)
      • XWAQAQUE.exe (PID: 7892)
      • messagestatistics.jpg.exe (PID: 8024)
      • sonylots.png.exe (PID: 5280)
      • xmlnext.jpg.exe (PID: 4996)
      • topicloans.jpg.exe (PID: 1388)
      • votefi.png.exe (PID: 7640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1970:01:01 00:02:03+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 197120
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x2d8ae
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
2 707
Monitored processes
89
Malicious processes
25
Suspicious processes
8

Behavior graph

Click at the process to see the details
start #VIRLOCK 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe #VIRLOCK swoycckm.exe #VIRLOCK xwaqaque.exe cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs #VIRLOCK 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs #VIRLOCK swoycckm.exe #VIRLOCK xwaqaque.exe slui.exe sonylots.png.exe no specs messagestatistics.jpg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs xmlnext.jpg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs votefi.png.exe no specs topicloans.jpg.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728C:\WINDOWS\system32\cmd.exe /c "C:\Users\admin\Desktop\2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock"C:\Windows\SysWOW64\cmd.exe—2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
976reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2C:\Windows\SysWOW64\reg.exe—2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1072\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1072\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1116reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1C:\Windows\SysWOW64\reg.exe—2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1116C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\jaMYcgAw.bat" "C:\Users\admin\Desktop\2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe""C:\Windows\SysWOW64\cmd.exe—2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1272C:\Users\admin\Desktop\2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlockC:\Users\admin\Desktop\2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
1324"C:\Users\admin\Desktop\2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe" C:\Users\admin\Desktop\2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
1388"C:\Users\admin\Downloads\topicloans.jpg.exe" C:\Users\admin\Downloads\topicloans.jpg.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\topicloans.jpg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
1452reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /fC:\Windows\SysWOW64\reg.exe—2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
7 978
Read events
7 972
Write events
6
Delete events
0

Modification events

(PID) Process:(1324) 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SwoYcckM.exe
Value:
C:\Users\admin\lEMYkwoU\SwoYcckM.exe
(PID) Process:(1324) 2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XWAQAQUE.exe
Value:
C:\ProgramData\usAgAgoI\XWAQAQUE.exe
(PID) Process:(5892) SwoYcckM.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SwoYcckM.exe
Value:
C:\Users\admin\lEMYkwoU\SwoYcckM.exe
(PID) Process:(5728) XWAQAQUE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XWAQAQUE.exe
Value:
C:\ProgramData\usAgAgoI\XWAQAQUE.exe
(PID) Process:(7920) SwoYcckM.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SwoYcckM.exe
Value:
C:\Users\admin\lEMYkwoU\SwoYcckM.exe
(PID) Process:(7892) XWAQAQUE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XWAQAQUE.exe
Value:
C:\ProgramData\usAgAgoI\XWAQAQUE.exe
Executable files
480
Suspicious files
0
Text files
141
Unknown types
0

Dropped files

PID
Process
Filename
Type
13242025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exeC:\Users\admin\AppData\Local\Temp\VKkkMgAw.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
13242025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exeC:\Users\admin\AppData\Local\Temp\mywEMgAw.battext
MD5:BC4470074EE6CBA13E9BE90855097085
SHA256:E3ECFEF8E1F5097048ABA579F0A8CE73BEB3477860BF4203DF4CCFC44EBEDA69
13242025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exeC:\Users\admin\lEMYkwoU\SwoYcckM.exeexecutable
MD5:D3C1071B0074F6CEDC97C2B97F67C953
SHA256:A18C09CEEE68D0417311F96BF5A2A183A7F713C76B9F59B909407A30AFFFCB56
13242025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exeC:\ProgramData\usAgAgoI\XWAQAQUE.exeexecutable
MD5:F826E280658C8A213D3091E81A1EC889
SHA256:26A2F1517686E58CADCB5DE65BFB0753234523453B0831B520D89DF15F571036
5892SwoYcckM.exeC:\Users\admin\lEMYkwoU\SwoYcckM.inftext
MD5:D7247C9AA614F7FE89B03E1F5D1566CB
SHA256:8BB344C420B786B8DB9AA9DD64F1D0BDCBD2756240684BE985058B59979698DF
12722025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exeC:\Users\admin\AppData\Local\Temp\UMUYcgAw.battext
MD5:EA89D84084436EE977247B87CECAC2DB
SHA256:885AC131BAF96D103103288101D736FE31EF61FD1B2237860A4CE2A16B64A63D
5728XWAQAQUE.exeC:\ProgramData\usAgAgoI\XWAQAQUE.inftext
MD5:D7247C9AA614F7FE89B03E1F5D1566CB
SHA256:8BB344C420B786B8DB9AA9DD64F1D0BDCBD2756240684BE985058B59979698DF
4944cmd.exeC:\Users\admin\AppData\Local\Temp\file.vbstext
MD5:4AFB5C4527091738FAF9CD4ADDF9D34E
SHA256:59D889A2BF392F4B117340832B4C73425A7FB1DE6C2F83A1AAA779D477C7C6CC
42682025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exeC:\Users\admin\AppData\Local\Temp\LqkIcgAw.battext
MD5:4EF4C5BC8D87449117917470EF681E3D
SHA256:E97D98D206224ADF102BFBC337E9CEA20A9CC8CE1C32FCC8E064604CE980A92F
74242025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock.exeC:\Users\admin\AppData\Local\Temp\xQsYcgAw.battext
MD5:E6F1FE3184B128FA889194311FDFE780
SHA256:F063B3B24474B69A04A7982D28CF26C4CDE29810EF7EAF07560B5BE7ACE3F76F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
50
DNS requests
19
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5892
SwoYcckM.exe
GET
—
142.250.185.110:80
http://google.com/
unknown
—
—
whitelisted
5728
XWAQAQUE.exe
GET
—
142.250.185.110:80
http://google.com/
unknown
—
—
whitelisted
7920
SwoYcckM.exe
GET
—
142.250.185.110:80
http://google.com/
unknown
—
—
whitelisted
7892
XWAQAQUE.exe
GET
—
142.250.185.110:80
http://google.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5728
XWAQAQUE.exe
200.87.164.69:9999
—
Entel S.A. - EntelNet
BO
unknown
5892
SwoYcckM.exe
200.87.164.69:9999
—
Entel S.A. - EntelNet
BO
unknown
5728
XWAQAQUE.exe
142.250.185.110:80
google.com
GOOGLE
US
whitelisted
5892
SwoYcckM.exe
142.250.185.110:80
google.com
GOOGLE
US
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7920
SwoYcckM.exe
200.87.164.69:9999
—
Entel S.A. - EntelNet
BO
unknown
7892
XWAQAQUE.exe
200.87.164.69:9999
—
Entel S.A. - EntelNet
BO
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
login.live.com
  • 20.190.160.132
  • 40.126.32.133
  • 20.190.160.67
  • 20.190.160.17
  • 40.126.32.140
  • 20.190.160.20
  • 20.190.160.3
  • 20.190.160.2
whitelisted

Threats

PID
Process
Class
Message
5892
SwoYcckM.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
5728
XWAQAQUE.exe
A Network Trojan was detected
RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in
5892
SwoYcckM.exe
A Network Trojan was detected
RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in
7892
XWAQAQUE.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7892
XWAQAQUE.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com)
5728
XWAQAQUE.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
5728
XWAQAQUE.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
7892
XWAQAQUE.exe
A Network Trojan was detected
RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in
7920
SwoYcckM.exe
A Network Trojan was detected
RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in
5728
XWAQAQUE.exe
A Network Trojan was detected
RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-16_af97a84ec18cc429e0273cfde917ba6a_elex_virlock