Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2025, 13:08
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe
-
Size
205KB
-
MD5
77dbefdf4110403384d3f64fdf4cbc68
-
SHA1
4217bc60938ea2f8c685eb93dd844d250819efb3
-
SHA256
66e35a160c927741102a10e7944d213c4d70e294988ef3692f6d04528c752759
-
SHA512
afe1c92d654966cf510b2a9a3050fe68016f2a81fa6c122cfceaaedcb1881bd2569b11fce109d176f1bc45207d6d1b41d3311b5fd801f02f4fa566f23646d47b
-
SSDEEP
3072:uuUK8EvwLzs4U/8E6hcOJJ4JJ0JJJJBJBJKJYJJJJ2JJuneiW3PPFekudJAMeh7N:uuUK8uCzs/93PPFeku7AH8oydSJH2U
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
UAC bypass 3 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (88) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 5 IoCs
flow pid Process 50 4680 Process not Found 54 4680 Process not Found 57 4680 Process not Found 58 4680 Process not Found 60 4680 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\International\Geo\Nation mugokIQs.exe -
Executes dropped EXE 4 IoCs
pid Process 6060 mugokIQs.exe 5736 jgsIgoUk.exe 4712 mugokIQs.exe 4728 jgsIgoUk.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zwIAYUgs.exe = "C:\\ProgramData\\rOMowAgg\\zwIAYUgs.exe" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mugokIQs.exe = "C:\\Users\\Admin\\RKIYAoAg\\mugokIQs.exe" 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jgsIgoUk.exe = "C:\\ProgramData\\TaQscUUo\\jgsIgoUk.exe" 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jgsIgoUk.exe = "C:\\ProgramData\\TaQscUUo\\jgsIgoUk.exe" jgsIgoUk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mugokIQs.exe = "C:\\Users\\Admin\\RKIYAoAg\\mugokIQs.exe" mugokIQs.exe Set value (str) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mugokIQs.exe = "C:\\Users\\Admin\\RKIYAoAg\\mugokIQs.exe" mugokIQs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jgsIgoUk.exe = "C:\\ProgramData\\TaQscUUo\\jgsIgoUk.exe" jgsIgoUk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kkcEQgQo.exe = "C:\\Users\\Admin\\NqwwgYAY\\kkcEQgQo.exe" Process not Found -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe mugokIQs.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe mugokIQs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 4980 3588 Process not Found 1960 3120 396 Process not Found 1961 1844 2976 Process not Found 1980 412 4528 Process not Found 1986 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2592 reg.exe 1560 reg.exe 4896 Process not Found 5748 reg.exe 2544 reg.exe 4608 Process not Found 4648 Process not Found 4068 reg.exe 1444 reg.exe 4628 reg.exe 2064 Process not Found 4540 reg.exe 4768 reg.exe 4764 reg.exe 680 reg.exe 3588 reg.exe 2576 reg.exe 4680 Process not Found 4752 Process not Found 1368 reg.exe 5840 reg.exe 1200 reg.exe 1004 Process not Found 1220 reg.exe 1440 reg.exe 668 reg.exe 5984 Process not Found 116 reg.exe 4228 reg.exe 2416 reg.exe 3564 reg.exe 5148 reg.exe 4196 Process not Found 4656 Process not Found 4368 Process not Found 1828 reg.exe 3084 reg.exe 3412 reg.exe 3056 reg.exe 2352 Process not Found 4724 reg.exe 1268 reg.exe 3604 reg.exe 1744 reg.exe 540 reg.exe 5444 reg.exe 1916 reg.exe 1824 reg.exe 388 reg.exe 4912 Process not Found 4692 Process not Found 4660 reg.exe 5924 Process not Found 1388 reg.exe 3476 reg.exe 3084 reg.exe 5956 reg.exe 1200 Process not Found 2396 reg.exe 1724 reg.exe 980 reg.exe 3084 reg.exe 3716 Process not Found 2760 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1588 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1588 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1588 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1588 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3940 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3940 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3940 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3940 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3744 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3744 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3744 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3744 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1824 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1824 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1824 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1824 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3364 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3364 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3364 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3364 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 100 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 100 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 100 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 100 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 624 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 624 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 624 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 624 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4892 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4892 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4892 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4892 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 2084 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 2084 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 2084 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 2084 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1840 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1840 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1840 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 1840 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4220 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4220 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4220 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4220 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3480 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3480 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3480 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 3480 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4852 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4852 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4852 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4852 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe -
Suspicious use of FindShellTrayWindow 19 IoCs
pid Process 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe 4712 mugokIQs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 6060 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 87 PID 3980 wrote to memory of 6060 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 87 PID 3980 wrote to memory of 6060 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 87 PID 3980 wrote to memory of 5736 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 90 PID 3980 wrote to memory of 5736 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 90 PID 3980 wrote to memory of 5736 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 90 PID 3980 wrote to memory of 2192 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 92 PID 3980 wrote to memory of 2192 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 92 PID 3980 wrote to memory of 2192 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 92 PID 3980 wrote to memory of 3100 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 95 PID 3980 wrote to memory of 3100 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 95 PID 3980 wrote to memory of 3100 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 95 PID 3980 wrote to memory of 3380 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 96 PID 3980 wrote to memory of 3380 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 96 PID 3980 wrote to memory of 3380 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 96 PID 3980 wrote to memory of 3520 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 97 PID 3980 wrote to memory of 3520 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 97 PID 3980 wrote to memory of 3520 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 97 PID 3980 wrote to memory of 320 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 98 PID 3980 wrote to memory of 320 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 98 PID 3980 wrote to memory of 320 3980 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 98 PID 2192 wrote to memory of 4596 2192 cmd.exe 103 PID 2192 wrote to memory of 4596 2192 cmd.exe 103 PID 2192 wrote to memory of 4596 2192 cmd.exe 103 PID 392 wrote to memory of 4712 392 cmd.exe 104 PID 392 wrote to memory of 4712 392 cmd.exe 104 PID 392 wrote to memory of 4712 392 cmd.exe 104 PID 2908 wrote to memory of 4728 2908 cmd.exe 105 PID 2908 wrote to memory of 4728 2908 cmd.exe 105 PID 2908 wrote to memory of 4728 2908 cmd.exe 105 PID 320 wrote to memory of 4664 320 cmd.exe 106 PID 320 wrote to memory of 4664 320 cmd.exe 106 PID 320 wrote to memory of 4664 320 cmd.exe 106 PID 4596 wrote to memory of 6104 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 107 PID 4596 wrote to memory of 6104 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 107 PID 4596 wrote to memory of 6104 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 107 PID 4596 wrote to memory of 5728 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 109 PID 4596 wrote to memory of 5728 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 109 PID 4596 wrote to memory of 5728 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 109 PID 4596 wrote to memory of 4652 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 110 PID 4596 wrote to memory of 4652 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 110 PID 4596 wrote to memory of 4652 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 110 PID 4596 wrote to memory of 1196 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 111 PID 4596 wrote to memory of 1196 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 111 PID 4596 wrote to memory of 1196 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 111 PID 4596 wrote to memory of 2912 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 112 PID 4596 wrote to memory of 2912 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 112 PID 4596 wrote to memory of 2912 4596 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 112 PID 2912 wrote to memory of 400 2912 cmd.exe 117 PID 2912 wrote to memory of 400 2912 cmd.exe 117 PID 2912 wrote to memory of 400 2912 cmd.exe 117 PID 6104 wrote to memory of 1588 6104 cmd.exe 118 PID 6104 wrote to memory of 1588 6104 cmd.exe 118 PID 6104 wrote to memory of 1588 6104 cmd.exe 118 PID 1588 wrote to memory of 1108 1588 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 120 PID 1588 wrote to memory of 1108 1588 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 120 PID 1588 wrote to memory of 1108 1588 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 120 PID 1108 wrote to memory of 3940 1108 cmd.exe 123 PID 1588 wrote to memory of 5236 1588 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 122 PID 1108 wrote to memory of 3940 1108 cmd.exe 123 PID 1108 wrote to memory of 3940 1108 cmd.exe 123 PID 1588 wrote to memory of 5236 1588 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 122 PID 1588 wrote to memory of 5236 1588 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 122 PID 1588 wrote to memory of 4024 1588 2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\RKIYAoAg\mugokIQs.exe"C:\Users\Admin\RKIYAoAg\mugokIQs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6060
-
-
C:\ProgramData\TaQscUUo\jgsIgoUk.exe"C:\ProgramData\TaQscUUo\jgsIgoUk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5736
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"8⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"10⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"12⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"14⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"16⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"18⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock19⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"20⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"22⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"24⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"26⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"28⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"30⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock31⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"32⤵PID:6140
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵PID:5848
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock33⤵PID:5464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"34⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock35⤵PID:3008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"36⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock37⤵PID:2592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"38⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock39⤵PID:4020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"40⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock41⤵PID:4000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"42⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock43⤵PID:316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"44⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock45⤵PID:4192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"46⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock47⤵PID:4768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"48⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock49⤵PID:5668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"50⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock51⤵PID:1180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"52⤵
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock53⤵PID:888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"54⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock55⤵
- System Location Discovery: System Language Discovery
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"56⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock57⤵PID:4992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"58⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock59⤵PID:2004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"60⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock61⤵
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"62⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock63⤵
- System Location Discovery: System Language Discovery
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"64⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock65⤵PID:4924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"66⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock67⤵PID:3928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"68⤵PID:5760
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵PID:4192
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock69⤵PID:2532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"70⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock71⤵PID:1552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"72⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock73⤵PID:1272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"74⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock75⤵PID:6080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"76⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock77⤵PID:4664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"78⤵
- System Location Discovery: System Language Discovery
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock79⤵PID:2192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"80⤵PID:1628
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:4056
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock81⤵PID:3564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"82⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock83⤵PID:2792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"84⤵
- System Location Discovery: System Language Discovery
PID:4492 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵PID:680
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock85⤵PID:4684
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"86⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock87⤵
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"88⤵PID:3552
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:4780
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock89⤵PID:4120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"90⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock91⤵PID:4632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"92⤵PID:2752
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵PID:2532
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock93⤵PID:2272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"94⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock95⤵PID:2544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"96⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock97⤵PID:2608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"98⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock99⤵PID:452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"100⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock101⤵PID:5744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"102⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock103⤵PID:5168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"104⤵
- System Location Discovery: System Language Discovery
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock105⤵
- System Location Discovery: System Language Discovery
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"106⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock107⤵PID:1732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"108⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock109⤵PID:4684
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"110⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock111⤵PID:3716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"112⤵PID:3928
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵PID:4924
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock113⤵PID:1824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"114⤵PID:4120
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:6104
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock115⤵PID:5836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"116⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock117⤵PID:2416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"118⤵
- System Location Discovery: System Language Discovery
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock119⤵PID:4112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"120⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock121⤵PID:2012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-18_77dbefdf4110403384d3f64fdf4cbc68_elex_virlock"122⤵PID:4796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-