Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2025, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe
Resource
win11-20250502-en
General
-
Target
2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe
-
Size
220KB
-
MD5
b1d41c804f79a9153d4fe8c6e8be4ece
-
SHA1
4292aec076397c0b1908c2c41d148159430e5ec3
-
SHA256
75c78679e60d2553a5cfd1bb4ec9683bdbe43b4b343e5d4aa0eac8050cbcf882
-
SHA512
68a7a93da96d91147c80715bac2d848ee3b322a24d574d156ca67a6bbf97053f32e5087a68e766eda5e72beb7e11ccf66e378df8d7cc9ee3cf3191144f4cd6f0
-
SSDEEP
3072:Eby7RPR7AoCwwMC5CXAc+rkoa8N2TYwQkEAgjp9SnTAysZjCcYozbcAcY:sytCoxwMC55mEAnQkGSTAy0j7Y8Tr
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
UAC bypass 3 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (86) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\International\Geo\Nation teoMscEc.exe -
Executes dropped EXE 4 IoCs
pid Process 3892 teoMscEc.exe 2576 xmYMQsUY.exe 4616 teoMscEc.exe 4584 xmYMQsUY.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teoMscEc.exe = "C:\\Users\\Admin\\mKggkkUc\\teoMscEc.exe" teoMscEc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xmYMQsUY.exe = "C:\\ProgramData\\KAoEwkAs\\xmYMQsUY.exe" xmYMQsUY.exe Set value (str) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teoMscEc.exe = "C:\\Users\\Admin\\mKggkkUc\\teoMscEc.exe" teoMscEc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xmYMQsUY.exe = "C:\\ProgramData\\KAoEwkAs\\xmYMQsUY.exe" xmYMQsUY.exe Set value (str) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teoMscEc.exe = "C:\\Users\\Admin\\mKggkkUc\\teoMscEc.exe" 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xmYMQsUY.exe = "C:\\ProgramData\\KAoEwkAs\\xmYMQsUY.exe" 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe teoMscEc.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe teoMscEc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Modifies registry key 1 TTPs 64 IoCs
pid Process 5416 Process not Found 4876 reg.exe 3584 reg.exe 2460 reg.exe 2256 reg.exe 3164 reg.exe 4808 reg.exe 532 reg.exe 5336 reg.exe 5676 reg.exe 5240 reg.exe 4840 reg.exe 5336 reg.exe 5384 reg.exe 4300 reg.exe 3996 reg.exe 780 reg.exe 3632 reg.exe 5012 reg.exe 3936 reg.exe 528 reg.exe 2220 reg.exe 5292 reg.exe 4024 reg.exe 5912 reg.exe 3744 reg.exe 2272 reg.exe 2980 reg.exe 3528 reg.exe 3396 reg.exe 1536 reg.exe 4444 reg.exe 4324 reg.exe 4404 reg.exe 1536 reg.exe 3996 Process not Found 428 Process not Found 2356 reg.exe 5240 reg.exe 2556 Process not Found 1084 reg.exe 5328 reg.exe 4320 reg.exe 5988 Process not Found 2100 reg.exe 4652 reg.exe 2740 reg.exe 1964 reg.exe 2036 reg.exe 5080 reg.exe 552 reg.exe 5772 reg.exe 4204 reg.exe 5172 reg.exe 1448 reg.exe 1676 Process not Found 448 reg.exe 5016 reg.exe 4796 Process not Found 2964 reg.exe 1676 reg.exe 3176 reg.exe 5112 reg.exe 3496 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4680 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4680 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4680 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4680 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4628 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4628 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4628 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4628 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1420 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1420 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1420 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1420 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 812 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 812 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 812 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 812 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 3556 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 3556 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 3556 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 3556 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5980 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5980 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5980 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5980 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4952 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4952 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4952 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 4952 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 836 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 836 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 836 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 836 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5520 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5520 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5520 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5520 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1156 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1156 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1156 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1156 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 2460 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 2460 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 2460 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 2460 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1900 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1900 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1900 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1900 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5988 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5988 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5988 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 5988 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1920 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1920 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1920 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 1920 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe -
Suspicious use of FindShellTrayWindow 19 IoCs
pid Process 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe 3892 teoMscEc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 3892 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 87 PID 2192 wrote to memory of 3892 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 87 PID 2192 wrote to memory of 3892 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 87 PID 2192 wrote to memory of 2576 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 89 PID 2192 wrote to memory of 2576 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 89 PID 2192 wrote to memory of 2576 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 89 PID 2192 wrote to memory of 1296 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 92 PID 2192 wrote to memory of 1296 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 92 PID 2192 wrote to memory of 1296 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 92 PID 2192 wrote to memory of 1340 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 95 PID 2192 wrote to memory of 1340 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 95 PID 2192 wrote to memory of 1340 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 95 PID 2192 wrote to memory of 5032 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 97 PID 2192 wrote to memory of 5032 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 97 PID 2192 wrote to memory of 5032 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 97 PID 2192 wrote to memory of 2900 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 98 PID 2192 wrote to memory of 2900 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 98 PID 2192 wrote to memory of 2900 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 98 PID 2192 wrote to memory of 3616 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 99 PID 2192 wrote to memory of 3616 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 99 PID 2192 wrote to memory of 3616 2192 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 99 PID 1296 wrote to memory of 4444 1296 cmd.exe 103 PID 1296 wrote to memory of 4444 1296 cmd.exe 103 PID 1296 wrote to memory of 4444 1296 cmd.exe 103 PID 2184 wrote to memory of 4616 2184 cmd.exe 104 PID 2184 wrote to memory of 4616 2184 cmd.exe 104 PID 2184 wrote to memory of 4616 2184 cmd.exe 104 PID 1252 wrote to memory of 4584 1252 cmd.exe 105 PID 1252 wrote to memory of 4584 1252 cmd.exe 105 PID 1252 wrote to memory of 4584 1252 cmd.exe 105 PID 3616 wrote to memory of 4512 3616 cmd.exe 106 PID 3616 wrote to memory of 4512 3616 cmd.exe 106 PID 3616 wrote to memory of 4512 3616 cmd.exe 106 PID 4444 wrote to memory of 5168 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 107 PID 4444 wrote to memory of 5168 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 107 PID 4444 wrote to memory of 5168 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 107 PID 4444 wrote to memory of 2008 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 109 PID 4444 wrote to memory of 2008 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 109 PID 4444 wrote to memory of 2008 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 109 PID 4444 wrote to memory of 1916 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 110 PID 4444 wrote to memory of 1916 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 110 PID 4444 wrote to memory of 1916 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 110 PID 4444 wrote to memory of 2200 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 111 PID 4444 wrote to memory of 2200 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 111 PID 4444 wrote to memory of 2200 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 111 PID 4444 wrote to memory of 4660 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 112 PID 4444 wrote to memory of 4660 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 112 PID 4444 wrote to memory of 4660 4444 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 112 PID 5168 wrote to memory of 4680 5168 cmd.exe 113 PID 5168 wrote to memory of 4680 5168 cmd.exe 113 PID 5168 wrote to memory of 4680 5168 cmd.exe 113 PID 4660 wrote to memory of 1972 4660 cmd.exe 118 PID 4660 wrote to memory of 1972 4660 cmd.exe 118 PID 4660 wrote to memory of 1972 4660 cmd.exe 118 PID 4680 wrote to memory of 6104 4680 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 119 PID 4680 wrote to memory of 6104 4680 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 119 PID 4680 wrote to memory of 6104 4680 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 119 PID 6104 wrote to memory of 4628 6104 cmd.exe 121 PID 6104 wrote to memory of 4628 6104 cmd.exe 121 PID 6104 wrote to memory of 4628 6104 cmd.exe 121 PID 4680 wrote to memory of 2044 4680 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 122 PID 4680 wrote to memory of 2044 4680 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 122 PID 4680 wrote to memory of 2044 4680 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 122 PID 4680 wrote to memory of 6084 4680 2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\mKggkkUc\teoMscEc.exe"C:\Users\Admin\mKggkkUc\teoMscEc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:3892
-
-
C:\ProgramData\KAoEwkAs\xmYMQsUY.exe"C:\ProgramData\KAoEwkAs\xmYMQsUY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"8⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"10⤵
- System Location Discovery: System Language Discovery
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"12⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"14⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"16⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock17⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"18⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"20⤵
- System Location Discovery: System Language Discovery
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"22⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"24⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"26⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"28⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"30⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"32⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock33⤵PID:1480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"34⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock35⤵PID:4356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"36⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock37⤵PID:5328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"38⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock39⤵PID:5224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"40⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock41⤵PID:5220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"42⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock43⤵PID:6056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"44⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock45⤵PID:2728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"46⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock47⤵PID:1908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"48⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock49⤵PID:3312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"50⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock51⤵PID:5884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"52⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock53⤵PID:3652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"54⤵PID:2400
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵PID:1900
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock55⤵PID:4664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"56⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock57⤵PID:60
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"58⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock59⤵PID:5864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"60⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock61⤵PID:4176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"62⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock63⤵PID:5924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"64⤵PID:4800
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:5988
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock65⤵PID:5956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"66⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock67⤵PID:2840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"68⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock69⤵PID:4820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"70⤵
- System Location Discovery: System Language Discovery
PID:508 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵PID:60
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock71⤵
- System Location Discovery: System Language Discovery
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"72⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock73⤵PID:5152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"74⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock75⤵PID:2928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"76⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock77⤵PID:4372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"78⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock79⤵PID:4832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"80⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock81⤵PID:3356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"82⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock83⤵PID:5692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"84⤵PID:5244
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵PID:3836
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock85⤵PID:5432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"86⤵
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock87⤵
- System Location Discovery: System Language Discovery
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"88⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock89⤵
- System Location Discovery: System Language Discovery
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"90⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock91⤵PID:5672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"92⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock93⤵PID:2104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"94⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock95⤵PID:2592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"96⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock97⤵PID:2100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"98⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock99⤵PID:812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"100⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock101⤵PID:4784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"102⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock103⤵PID:1340
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"104⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock105⤵PID:1600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"106⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock107⤵PID:1416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"108⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock109⤵PID:2616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"110⤵PID:3800
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:508
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock111⤵PID:2904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"112⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock113⤵PID:5992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"114⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock115⤵PID:6060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"116⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock117⤵
- System Location Discovery: System Language Discovery
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"118⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock119⤵PID:4628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"120⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock121⤵PID:2552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-19_b1d41c804f79a9153d4fe8c6e8be4ece_elex_virlock"122⤵PID:60
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-