Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 05:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe
-
Size
117KB
-
MD5
e9d4796319f758c383ec212ba8dac130
-
SHA1
085a2681e9ab5a1b4db78b8987de0d3326a54f08
-
SHA256
c15f130a35c8d363abc25427cf994c4eda8b3a171e528cddb7b5046b29aaeef1
-
SHA512
6a6c880b330b370bbe2eac482c8474c169b125c8686ce480565e95dd08fb87a20932aa2d03f256439460aa2a10904709a4c44d05eb1a5cb438193c7d5ef60207
-
SSDEEP
3072:a9UuK+WQq3bxHGJEePFkBxWbpZAdIpDNr5Xi/eRZ34t3Y:a9mNZWP4mr82RZItI
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation ZcsgocQM.exe -
Executes dropped EXE 2 IoCs
pid Process 3280 GecoUoQg.exe 864 ZcsgocQM.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kysgYkUo.exe = "C:\\ProgramData\\kWcAcAMw\\kysgYkUo.exe" 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GecoUoQg.exe = "C:\\Users\\Admin\\MIIkEIEg\\GecoUoQg.exe" 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZcsgocQM.exe = "C:\\ProgramData\\rYcIIcMs\\ZcsgocQM.exe" 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GecoUoQg.exe = "C:\\Users\\Admin\\MIIkEIEg\\GecoUoQg.exe" GecoUoQg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZcsgocQM.exe = "C:\\ProgramData\\rYcIIcMs\\ZcsgocQM.exe" ZcsgocQM.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AggMggwU.exe = "C:\\Users\\Admin\\AMQgMsEI\\AggMggwU.exe" 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\shell32.dll.exe GecoUoQg.exe File created C:\Windows\SysWOW64\shell32.dll.exe GecoUoQg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2924 3992 WerFault.exe 189 1144 4828 WerFault.exe 190 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2168 reg.exe 4112 reg.exe 1536 reg.exe 2356 reg.exe 1392 reg.exe 2956 reg.exe 3440 reg.exe 3668 reg.exe 3160 reg.exe 3912 reg.exe 396 reg.exe 3608 reg.exe 5016 reg.exe 1536 reg.exe 3160 reg.exe 3224 reg.exe 1236 reg.exe 2476 reg.exe 396 reg.exe 4996 reg.exe 1820 reg.exe 2964 reg.exe 4028 reg.exe 4292 reg.exe 4016 reg.exe 2360 reg.exe 4856 reg.exe 4964 reg.exe 4428 reg.exe 3212 reg.exe 916 reg.exe 2760 reg.exe 2840 reg.exe 3812 reg.exe 4860 reg.exe 4268 reg.exe 4060 reg.exe 4020 reg.exe 4892 reg.exe 4524 reg.exe 4200 reg.exe 2816 reg.exe 2096 reg.exe 2880 reg.exe 4112 reg.exe 1520 reg.exe 3140 reg.exe 2364 reg.exe 4692 reg.exe 1456 reg.exe 3348 reg.exe 2492 reg.exe 2260 reg.exe 4112 reg.exe 936 reg.exe 3192 reg.exe 2852 reg.exe 1940 reg.exe 1792 reg.exe 448 reg.exe 1520 reg.exe 3160 reg.exe 1876 reg.exe 3124 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 3580 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 3580 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 3580 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 3580 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2944 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2944 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2944 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2944 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 716 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 716 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 716 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 716 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2892 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2892 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2892 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 2892 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1876 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1876 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1876 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 1876 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4352 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4352 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4352 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4352 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 3476 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 3476 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 3476 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 3476 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4432 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4432 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4432 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4432 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4972 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4972 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4972 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4972 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4060 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4060 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4060 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4060 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4832 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4832 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4832 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4832 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4980 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4980 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4980 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 4980 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 772 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 772 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 772 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 772 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 864 ZcsgocQM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe 864 ZcsgocQM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4528 wrote to memory of 3280 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 88 PID 4528 wrote to memory of 3280 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 88 PID 4528 wrote to memory of 3280 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 88 PID 4528 wrote to memory of 864 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 89 PID 4528 wrote to memory of 864 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 89 PID 4528 wrote to memory of 864 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 89 PID 4528 wrote to memory of 2088 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 90 PID 4528 wrote to memory of 2088 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 90 PID 4528 wrote to memory of 2088 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 90 PID 4528 wrote to memory of 2636 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 92 PID 4528 wrote to memory of 2636 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 92 PID 4528 wrote to memory of 2636 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 92 PID 4528 wrote to memory of 5016 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 93 PID 4528 wrote to memory of 5016 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 93 PID 4528 wrote to memory of 5016 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 93 PID 4528 wrote to memory of 4828 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 94 PID 4528 wrote to memory of 4828 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 94 PID 4528 wrote to memory of 4828 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 94 PID 4528 wrote to memory of 4824 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 95 PID 4528 wrote to memory of 4824 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 95 PID 4528 wrote to memory of 4824 4528 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 95 PID 2088 wrote to memory of 4912 2088 cmd.exe 98 PID 2088 wrote to memory of 4912 2088 cmd.exe 98 PID 2088 wrote to memory of 4912 2088 cmd.exe 98 PID 4824 wrote to memory of 5012 4824 cmd.exe 101 PID 4824 wrote to memory of 5012 4824 cmd.exe 101 PID 4824 wrote to memory of 5012 4824 cmd.exe 101 PID 4912 wrote to memory of 4808 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 102 PID 4912 wrote to memory of 4808 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 102 PID 4912 wrote to memory of 4808 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 102 PID 4808 wrote to memory of 1236 4808 cmd.exe 104 PID 4808 wrote to memory of 1236 4808 cmd.exe 104 PID 4808 wrote to memory of 1236 4808 cmd.exe 104 PID 4912 wrote to memory of 1668 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 105 PID 4912 wrote to memory of 1668 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 105 PID 4912 wrote to memory of 1668 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 105 PID 4912 wrote to memory of 3224 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 106 PID 4912 wrote to memory of 3224 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 106 PID 4912 wrote to memory of 3224 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 106 PID 4912 wrote to memory of 4860 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 107 PID 4912 wrote to memory of 4860 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 107 PID 4912 wrote to memory of 4860 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 107 PID 4912 wrote to memory of 4580 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 108 PID 4912 wrote to memory of 4580 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 108 PID 4912 wrote to memory of 4580 4912 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 108 PID 4580 wrote to memory of 2364 4580 cmd.exe 113 PID 4580 wrote to memory of 2364 4580 cmd.exe 113 PID 4580 wrote to memory of 2364 4580 cmd.exe 113 PID 1236 wrote to memory of 2728 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 114 PID 1236 wrote to memory of 2728 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 114 PID 1236 wrote to memory of 2728 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 114 PID 2728 wrote to memory of 3580 2728 cmd.exe 116 PID 2728 wrote to memory of 3580 2728 cmd.exe 116 PID 2728 wrote to memory of 3580 2728 cmd.exe 116 PID 1236 wrote to memory of 4356 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 117 PID 1236 wrote to memory of 4356 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 117 PID 1236 wrote to memory of 4356 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 117 PID 1236 wrote to memory of 4060 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 118 PID 1236 wrote to memory of 4060 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 118 PID 1236 wrote to memory of 4060 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 118 PID 1236 wrote to memory of 2744 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 119 PID 1236 wrote to memory of 2744 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 119 PID 1236 wrote to memory of 2744 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 119 PID 1236 wrote to memory of 2476 1236 2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\MIIkEIEg\GecoUoQg.exe"C:\Users\Admin\MIIkEIEg\GecoUoQg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3280
-
-
C:\ProgramData\rYcIIcMs\ZcsgocQM.exe"C:\ProgramData\rYcIIcMs\ZcsgocQM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:864
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"8⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"10⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"12⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"14⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"16⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock17⤵
- Adds Run key to start application
PID:2360 -
C:\Users\Admin\AMQgMsEI\AggMggwU.exe"C:\Users\Admin\AMQgMsEI\AggMggwU.exe"18⤵PID:3992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 23219⤵
- Program crash
PID:2924
-
-
-
C:\ProgramData\kWcAcAMw\kysgYkUo.exe"C:\ProgramData\kWcAcAMw\kysgYkUo.exe"18⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 22819⤵
- Program crash
PID:1144
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"18⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"20⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"22⤵PID:4960
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"24⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"26⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"28⤵PID:4856
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"30⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"32⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"34⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock35⤵PID:5004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"36⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock37⤵PID:1952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"38⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock39⤵PID:2168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"40⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock41⤵PID:5016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"42⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock43⤵PID:3020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"44⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock45⤵PID:2216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"46⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock47⤵PID:4932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"48⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock49⤵PID:1884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"50⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock51⤵PID:996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"52⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock53⤵PID:4420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"54⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock55⤵PID:668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"56⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock57⤵PID:2508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"58⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock59⤵PID:4860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"60⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock61⤵PID:3416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"62⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock63⤵PID:3796
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"64⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock65⤵PID:3976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"66⤵PID:2688
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵PID:3860
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock67⤵PID:1060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"68⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock69⤵PID:4052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"70⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock71⤵PID:668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"72⤵PID:2892
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵PID:3416
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock73⤵PID:2096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"74⤵PID:2956
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵PID:4840
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock75⤵PID:2940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"76⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock77⤵PID:1200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"78⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock79⤵PID:1060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"80⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock81⤵PID:3484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"82⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock83⤵PID:3904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"84⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock85⤵PID:2260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"86⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock87⤵PID:3100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"88⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock89⤵PID:2168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"90⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock91⤵PID:2100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"92⤵PID:4292
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵PID:1820
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock93⤵PID:4872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"94⤵PID:936
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock95⤵PID:3224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"96⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock97⤵PID:448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"98⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock99⤵PID:1144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"100⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock101⤵PID:4868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"102⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock103⤵PID:396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"104⤵PID:4200
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵PID:4348
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock105⤵PID:1964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"106⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock107⤵PID:4948
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"108⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock109⤵PID:2216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"110⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock111⤵PID:4664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"112⤵PID:4964
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock113⤵PID:3676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"114⤵PID:2564
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:640
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock115⤵PID:2052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"116⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock117⤵PID:728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"118⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock119⤵PID:656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"120⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock121⤵PID:3812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-19_e9d4796319f758c383ec212ba8dac130_virlock"122⤵PID:3508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-