Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2025, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe
-
Size
209KB
-
MD5
b77e4537856ca9970675e2cc74539e4d
-
SHA1
4226717c1f891a20d23aaafd64a1981a03e400e2
-
SHA256
f1f5aaf209f61e8c50313fe2356e5d2d64035dc33ab435e148ed14c821b112f4
-
SHA512
d40e3547bc07cafc839adcbee2c22bdd2f03f839d68072c00b602e098f009d00f1c2ad6ae9592c47119cfac8138064d47eaa429ae9b42b63a66bf60f614c5350
-
SSDEEP
6144:rAFlVeUn31G8WdCooJbNuRf5MrsF8/BIpAvIyWR:05hFG8ICooJbNuRf5Mrs+BvIy+
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
UAC bypass 3 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (86) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 8 IoCs
flow pid Process 48 2820 Process not Found 52 2820 Process not Found 55 2820 Process not Found 56 2820 Process not Found 58 2820 Process not Found 61 3324 Process not Found 62 3324 Process not Found 63 3324 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\Control Panel\International\Geo\Nation GMUIkQQg.exe -
Executes dropped EXE 4 IoCs
pid Process 2900 GMUIkQQg.exe 2252 jAYIAUgM.exe 4764 GMUIkQQg.exe 692 jAYIAUgM.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jAYIAUgM.exe = "C:\\ProgramData\\CeIskIMw\\jAYIAUgM.exe" jAYIAUgM.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GMUIkQQg.exe = "C:\\Users\\Admin\\FscEkYAI\\GMUIkQQg.exe" GMUIkQQg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jAYIAUgM.exe = "C:\\ProgramData\\CeIskIMw\\jAYIAUgM.exe" jAYIAUgM.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GMUIkQQg.exe = "C:\\Users\\Admin\\FscEkYAI\\GMUIkQQg.exe" 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jAYIAUgM.exe = "C:\\ProgramData\\CeIskIMw\\jAYIAUgM.exe" 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GMUIkQQg.exe = "C:\\Users\\Admin\\FscEkYAI\\GMUIkQQg.exe" GMUIkQQg.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe GMUIkQQg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 844 Process not Found 736 reg.exe 3624 reg.exe 3676 reg.exe 632 Process not Found 4828 reg.exe 1264 reg.exe 4796 Process not Found 3768 Process not Found 5116 reg.exe 3384 reg.exe 3636 reg.exe 3016 reg.exe 4792 reg.exe 1460 reg.exe 2652 Process not Found 3876 reg.exe 3012 Process not Found 2260 reg.exe 4424 reg.exe 4348 reg.exe 1964 reg.exe 4692 reg.exe 1432 reg.exe 4800 Process not Found 2276 reg.exe 852 reg.exe 3620 reg.exe 4888 reg.exe 2808 Process not Found 3296 Process not Found 1724 reg.exe 3140 reg.exe 1684 reg.exe 4292 reg.exe 1748 reg.exe 3088 reg.exe 1104 Process not Found 3324 reg.exe 2672 reg.exe 2016 Process not Found 4792 Process not Found 1264 reg.exe 4432 reg.exe 2404 reg.exe 4836 reg.exe 3152 reg.exe 1584 Process not Found 4224 reg.exe 4428 reg.exe 3780 reg.exe 852 reg.exe 1104 reg.exe 5104 reg.exe 3984 Process not Found 1432 reg.exe 3504 Process not Found 4648 reg.exe 4828 reg.exe 3620 reg.exe 5008 reg.exe 852 Process not Found 4800 Process not Found 2456 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2684 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2684 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2684 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2684 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 628 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 628 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 628 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 628 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 3448 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 3448 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 3448 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 3448 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4156 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4156 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4156 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4156 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4872 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4872 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4872 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4872 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 368 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 368 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 368 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 368 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2908 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2908 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2908 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2908 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 5044 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 5044 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 5044 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 5044 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4816 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4816 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4816 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 4816 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 5088 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 5088 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 5088 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 5088 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2536 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2536 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2536 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2536 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 3452 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 3452 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 3452 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 3452 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 1160 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 1160 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 1160 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 1160 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2536 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2536 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2536 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 2536 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe -
Suspicious use of FindShellTrayWindow 20 IoCs
pid Process 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe 2900 GMUIkQQg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3084 wrote to memory of 2900 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 89 PID 3084 wrote to memory of 2900 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 89 PID 3084 wrote to memory of 2900 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 89 PID 3084 wrote to memory of 2252 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 92 PID 3084 wrote to memory of 2252 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 92 PID 3084 wrote to memory of 2252 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 92 PID 3084 wrote to memory of 5100 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 227 PID 3084 wrote to memory of 5100 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 227 PID 3084 wrote to memory of 5100 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 227 PID 3084 wrote to memory of 1620 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 97 PID 3084 wrote to memory of 1620 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 97 PID 3084 wrote to memory of 1620 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 97 PID 3084 wrote to memory of 852 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 98 PID 3084 wrote to memory of 852 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 98 PID 3084 wrote to memory of 852 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 98 PID 3084 wrote to memory of 1936 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 99 PID 3084 wrote to memory of 1936 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 99 PID 3084 wrote to memory of 1936 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 99 PID 3084 wrote to memory of 2176 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 100 PID 3084 wrote to memory of 2176 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 100 PID 3084 wrote to memory of 2176 3084 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 100 PID 5100 wrote to memory of 2528 5100 cmd.exe 171 PID 5100 wrote to memory of 2528 5100 cmd.exe 171 PID 5100 wrote to memory of 2528 5100 cmd.exe 171 PID 3092 wrote to memory of 4764 3092 cmd.exe 106 PID 3092 wrote to memory of 4764 3092 cmd.exe 106 PID 3092 wrote to memory of 4764 3092 cmd.exe 106 PID 2176 wrote to memory of 1884 2176 cmd.exe 107 PID 2176 wrote to memory of 1884 2176 cmd.exe 107 PID 2176 wrote to memory of 1884 2176 cmd.exe 107 PID 3660 wrote to memory of 692 3660 cmd.exe 108 PID 3660 wrote to memory of 692 3660 cmd.exe 108 PID 3660 wrote to memory of 692 3660 cmd.exe 108 PID 2528 wrote to memory of 396 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 158 PID 2528 wrote to memory of 396 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 158 PID 2528 wrote to memory of 396 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 158 PID 396 wrote to memory of 2684 396 cmd.exe 111 PID 396 wrote to memory of 2684 396 cmd.exe 111 PID 396 wrote to memory of 2684 396 cmd.exe 111 PID 2528 wrote to memory of 4888 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 112 PID 2528 wrote to memory of 4888 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 112 PID 2528 wrote to memory of 4888 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 112 PID 2528 wrote to memory of 4620 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 113 PID 2528 wrote to memory of 4620 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 113 PID 2528 wrote to memory of 4620 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 113 PID 2528 wrote to memory of 2020 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 114 PID 2528 wrote to memory of 2020 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 114 PID 2528 wrote to memory of 2020 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 114 PID 2528 wrote to memory of 4444 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 115 PID 2528 wrote to memory of 4444 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 115 PID 2528 wrote to memory of 4444 2528 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 115 PID 4444 wrote to memory of 3904 4444 cmd.exe 120 PID 4444 wrote to memory of 3904 4444 cmd.exe 120 PID 4444 wrote to memory of 3904 4444 cmd.exe 120 PID 2684 wrote to memory of 4128 2684 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 170 PID 2684 wrote to memory of 4128 2684 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 170 PID 2684 wrote to memory of 4128 2684 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 170 PID 4128 wrote to memory of 628 4128 cmd.exe 123 PID 4128 wrote to memory of 628 4128 cmd.exe 123 PID 4128 wrote to memory of 628 4128 cmd.exe 123 PID 2684 wrote to memory of 3104 2684 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 201 PID 2684 wrote to memory of 3104 2684 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 201 PID 2684 wrote to memory of 3104 2684 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 201 PID 2684 wrote to memory of 4320 2684 2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\FscEkYAI\GMUIkQQg.exe"C:\Users\Admin\FscEkYAI\GMUIkQQg.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:2900
-
-
C:\ProgramData\CeIskIMw\jAYIAUgM.exe"C:\ProgramData\CeIskIMw\jAYIAUgM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"8⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"10⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"12⤵PID:4996
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵PID:396
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"14⤵PID:1956
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV115⤵PID:4128
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"16⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"18⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"20⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"22⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"24⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"26⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"28⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"30⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"32⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock33⤵PID:1440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"34⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock35⤵PID:4648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"36⤵PID:1748
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock37⤵PID:3144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"38⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock39⤵PID:2036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"40⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock41⤵PID:4184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"42⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock43⤵PID:2768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"44⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock45⤵PID:3068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"46⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock47⤵PID:4360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"48⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock49⤵
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"50⤵PID:1564
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵PID:5088
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock51⤵PID:2260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"52⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock53⤵PID:3932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"54⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock55⤵PID:2176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"56⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock57⤵PID:4056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"58⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock59⤵PID:4584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"60⤵PID:3324
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵PID:436
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock61⤵PID:1528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"62⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock63⤵PID:4628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"64⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock65⤵PID:4564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"66⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock67⤵PID:4828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"68⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock69⤵PID:2012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"70⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock71⤵PID:2780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"72⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock73⤵PID:784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"74⤵PID:4932
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵PID:3616
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock75⤵PID:2732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"76⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock77⤵PID:4424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"78⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock79⤵PID:2876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"80⤵PID:2012
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:3104
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock81⤵PID:4576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"82⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock83⤵PID:2156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"84⤵PID:3052
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵PID:4144
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock85⤵PID:4872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"86⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock87⤵PID:4296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"88⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock89⤵PID:736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"90⤵PID:840
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵PID:4432
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock91⤵PID:3452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"92⤵
- System Location Discovery: System Language Discovery
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock93⤵PID:1352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"94⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock95⤵PID:3488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"96⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock97⤵PID:2912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"98⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock99⤵PID:4628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"100⤵PID:3480
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵PID:3412
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock101⤵PID:3152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"102⤵
- System Location Discovery: System Language Discovery
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock103⤵PID:4872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"104⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock105⤵PID:4224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"106⤵PID:4308
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:1040
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock107⤵PID:4704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"108⤵PID:4940
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:1440
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock109⤵PID:3896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"110⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock111⤵PID:1064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"112⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock113⤵PID:2752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"114⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock115⤵PID:1196
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"116⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock117⤵PID:3644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"118⤵PID:2012
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵PID:3624
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock119⤵PID:2428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"120⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock121⤵PID:1104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_b77e4537856ca9970675e2cc74539e4d_elex_virlock"122⤵PID:2424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-