Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 15:23
Static task
static1
Behavioral task
behavioral1
Sample
4839574d3807246a5f6779f2a658f781_virlock_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4839574d3807246a5f6779f2a658f781_virlock_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
4839574d3807246a5f6779f2a658f781_virlock_JC.exe
-
Size
915KB
-
MD5
4839574d3807246a5f6779f2a658f781
-
SHA1
7ac16bec3781c185e32189baf01cf4b0c101017e
-
SHA256
c3c62d89f3251859a83c919319f6a8eaef90ad35da47e697abc977e8b7de1e42
-
SHA512
87aabb2a51be67b841bfde6d7b9930a116e933aeb1ae2439205ca3520fa3db856c97bb04b8bed68da8506bc6a2ed3cec9cba8a1c120e6a6fe4d6741354f6896a
-
SSDEEP
12288:srkbeZTah2U2Q2PumWuK7I3gk47/Zb1C3EJ3+BycVcX6XE5+AtB1S++8fDUk4smF:s4CZGH2QHNG4V1CUNFuMHfik/HeN
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found -
Blocklisted process makes network request 4 IoCs
flow pid Process 32 1216 cscript.exe 36 1216 cscript.exe 38 1216 cscript.exe 40 1216 cscript.exe -
Executes dropped EXE 2 IoCs
pid Process 1848 VQgEsQEo.exe 4200 ZiQUkQIw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZiQUkQIw.exe = "C:\\ProgramData\\rkYckYkQ\\ZiQUkQIw.exe" 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VQgEsQEo.exe = "C:\\Users\\Admin\\aIckUMUA\\VQgEsQEo.exe" VQgEsQEo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZiQUkQIw.exe = "C:\\ProgramData\\rkYckYkQ\\ZiQUkQIw.exe" ZiQUkQIw.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VQgEsQEo.exe = "C:\\Users\\Admin\\aIckUMUA\\VQgEsQEo.exe" 4839574d3807246a5f6779f2a658f781_virlock_JC.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe VQgEsQEo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 4776 reg.exe 3924 reg.exe 2056 reg.exe 2940 reg.exe 4664 reg.exe 3360 reg.exe 3652 reg.exe 3804 reg.exe 3768 reg.exe 1308 reg.exe 1612 reg.exe 2560 reg.exe 4392 reg.exe 4752 reg.exe 3608 reg.exe 3648 reg.exe 4940 reg.exe 220 reg.exe 2428 reg.exe 1808 reg.exe 3156 reg.exe 2452 reg.exe 1264 reg.exe 5036 reg.exe 2208 reg.exe 3428 reg.exe 2836 reg.exe 5012 reg.exe 2244 reg.exe 1280 reg.exe 3836 reg.exe 1304 reg.exe 4848 reg.exe 4432 reg.exe 1276 reg.exe 2620 reg.exe 4036 reg.exe 3988 reg.exe 3608 reg.exe 3592 reg.exe 4888 reg.exe 1492 reg.exe 888 reg.exe 4216 reg.exe 1212 reg.exe 1664 reg.exe 1120 reg.exe 4264 reg.exe 3740 reg.exe 1212 reg.exe 2184 reg.exe 4292 reg.exe 4376 reg.exe 2560 reg.exe 3048 reg.exe 4488 reg.exe 1536 reg.exe 2008 reg.exe 2148 reg.exe 2688 reg.exe 2524 reg.exe 2124 reg.exe 4856 reg.exe 2624 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 540 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 540 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 540 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 540 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 3620 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 3620 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 3620 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 3620 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 4716 cscript.exe 4716 cscript.exe 4716 cscript.exe 4716 cscript.exe 1664 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 1664 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 1664 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 1664 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 1644 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 1644 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 1644 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 1644 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 4304 reg.exe 4304 reg.exe 4304 reg.exe 4304 reg.exe 3728 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 3728 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 3728 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 3728 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 3768 Conhost.exe 3768 Conhost.exe 3768 Conhost.exe 3768 Conhost.exe 760 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 760 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 760 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 760 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 2216 reg.exe 2216 reg.exe 2216 reg.exe 2216 reg.exe 3996 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 3996 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 3996 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 3996 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 2524 Conhost.exe 2524 Conhost.exe 2524 Conhost.exe 2524 Conhost.exe 2976 Conhost.exe 2976 Conhost.exe 2976 Conhost.exe 2976 Conhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1848 VQgEsQEo.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe 1848 VQgEsQEo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 1848 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 82 PID 2776 wrote to memory of 1848 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 82 PID 2776 wrote to memory of 1848 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 82 PID 2776 wrote to memory of 4200 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 83 PID 2776 wrote to memory of 4200 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 83 PID 2776 wrote to memory of 4200 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 83 PID 2776 wrote to memory of 4964 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 84 PID 2776 wrote to memory of 4964 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 84 PID 2776 wrote to memory of 4964 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 84 PID 2776 wrote to memory of 3804 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 86 PID 2776 wrote to memory of 3804 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 86 PID 2776 wrote to memory of 3804 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 86 PID 2776 wrote to memory of 3432 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 93 PID 2776 wrote to memory of 3432 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 93 PID 2776 wrote to memory of 3432 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 93 PID 2776 wrote to memory of 760 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 92 PID 2776 wrote to memory of 760 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 92 PID 2776 wrote to memory of 760 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 92 PID 2776 wrote to memory of 376 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 87 PID 2776 wrote to memory of 376 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 87 PID 2776 wrote to memory of 376 2776 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 87 PID 4964 wrote to memory of 4940 4964 cmd.exe 94 PID 4964 wrote to memory of 4940 4964 cmd.exe 94 PID 4964 wrote to memory of 4940 4964 cmd.exe 94 PID 376 wrote to memory of 3032 376 cmd.exe 95 PID 376 wrote to memory of 3032 376 cmd.exe 95 PID 376 wrote to memory of 3032 376 cmd.exe 95 PID 4940 wrote to memory of 2740 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 96 PID 4940 wrote to memory of 2740 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 96 PID 4940 wrote to memory of 2740 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 96 PID 4940 wrote to memory of 4276 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 98 PID 4940 wrote to memory of 4276 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 98 PID 4940 wrote to memory of 4276 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 98 PID 4940 wrote to memory of 2836 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 101 PID 4940 wrote to memory of 2836 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 101 PID 4940 wrote to memory of 2836 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 101 PID 4940 wrote to memory of 512 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 99 PID 4940 wrote to memory of 512 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 99 PID 4940 wrote to memory of 512 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 99 PID 4940 wrote to memory of 4508 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 103 PID 4940 wrote to memory of 4508 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 103 PID 4940 wrote to memory of 4508 4940 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 103 PID 2740 wrote to memory of 4228 2740 cmd.exe 106 PID 2740 wrote to memory of 4228 2740 cmd.exe 106 PID 2740 wrote to memory of 4228 2740 cmd.exe 106 PID 4508 wrote to memory of 2104 4508 cmd.exe 107 PID 4508 wrote to memory of 2104 4508 cmd.exe 107 PID 4508 wrote to memory of 2104 4508 cmd.exe 107 PID 4228 wrote to memory of 5028 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 108 PID 4228 wrote to memory of 5028 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 108 PID 4228 wrote to memory of 5028 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 108 PID 5028 wrote to memory of 540 5028 cmd.exe 110 PID 5028 wrote to memory of 540 5028 cmd.exe 110 PID 5028 wrote to memory of 540 5028 cmd.exe 110 PID 4228 wrote to memory of 1600 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 118 PID 4228 wrote to memory of 1600 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 118 PID 4228 wrote to memory of 1600 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 118 PID 4228 wrote to memory of 3972 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 117 PID 4228 wrote to memory of 3972 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 117 PID 4228 wrote to memory of 3972 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 117 PID 4228 wrote to memory of 1832 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 116 PID 4228 wrote to memory of 1832 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 116 PID 4228 wrote to memory of 1832 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 116 PID 4228 wrote to memory of 4112 4228 4839574d3807246a5f6779f2a658f781_virlock_JC.exe 111 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4839574d3807246a5f6779f2a658f781_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exe"C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\aIckUMUA\VQgEsQEo.exe"C:\Users\Admin\aIckUMUA\VQgEsQEo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1848
-
-
C:\ProgramData\rkYckYkQ\ZiQUkQIw.exe"C:\ProgramData\rkYckYkQ\ZiQUkQIw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4200
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"2⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"4⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"6⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC7⤵
- Suspicious behavior: EnumeratesProcesses
PID:540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"8⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"10⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC11⤵PID:4716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"12⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"14⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"16⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC17⤵PID:4304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"18⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC19⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"20⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC21⤵PID:3768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"22⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC23⤵PID:760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"24⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC25⤵PID:2216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"26⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"28⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC29⤵PID:2524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"30⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC31⤵PID:2976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"32⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC33⤵PID:4100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"34⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC35⤵PID:324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"36⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC37⤵PID:3124
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"38⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC39⤵PID:3552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"40⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC41⤵PID:4672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"42⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC43⤵
- Suspicious behavior: EnumeratesProcesses
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"44⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC45⤵PID:3788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"46⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC47⤵PID:4528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"48⤵PID:4444
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵PID:1612
-
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC49⤵PID:1480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"50⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC51⤵PID:2912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"52⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC53⤵PID:1536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"54⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC55⤵PID:1620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"56⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC57⤵PID:440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"58⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC59⤵PID:228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"60⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC61⤵PID:3648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"62⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC63⤵PID:2688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"64⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC65⤵PID:1656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"66⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC67⤵PID:1728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"68⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC69⤵PID:1188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"70⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC71⤵PID:2344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"72⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC73⤵PID:3300
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"74⤵PID:3124
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
- UAC bypass
PID:2204
-
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC75⤵PID:4736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"76⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC77⤵PID:4296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"78⤵PID:4664
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵PID:4444
-
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC79⤵PID:1764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"80⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC81⤵PID:5072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"82⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC83⤵PID:4548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"84⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC85⤵PID:1656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"86⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC87⤵PID:1696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"88⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC89⤵PID:1000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"90⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC91⤵PID:1432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"92⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC93⤵PID:3208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"94⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC95⤵PID:8
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"96⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC97⤵PID:3188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"98⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC99⤵PID:888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"100⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC101⤵PID:4540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"102⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC103⤵PID:460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"104⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC105⤵PID:2656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"106⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC107⤵PID:1120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"108⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC109⤵PID:4376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"110⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC111⤵PID:3392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"112⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC113⤵PID:1876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"114⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC115⤵PID:2644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"116⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC117⤵PID:1480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"118⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC119⤵PID:4816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"120⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC121⤵PID:4992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4839574d3807246a5f6779f2a658f781_virlock_JC"122⤵PID:232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-