Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2025, 10:35
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe
Resource
win11-20250502-en
General
-
Target
2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe
-
Size
181KB
-
MD5
f8bf3340ea587acc2f96c24372f29edf
-
SHA1
3ace4837343f21c73e38517b8e44f6010450fc53
-
SHA256
4e570261798b1f8ea4b1793efd7f4b0fb5a109a99a1dd2bc2dd5859e46df4968
-
SHA512
36d59f407063822b8c8f5216d3abf8d835c0ed885c446844223e561333c450445b448c3d19a6612979bf7f1e88aaef7fe50f2193360ceb334c93dbc70c74551d
-
SSDEEP
3072:SiSl8WNKYkMqLwwl5XBZ6Sz1Jq3CgRkiGgmWL3v6HkrkKfPn7JBDwk4k5OXgSe19:SiqNCtBFz1o9RkiGgmWL3v9kKfDJaole
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
UAC bypass 3 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (89) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\Control Panel\International\Geo\Nation ggkkIEYQ.exe -
Executes dropped EXE 4 IoCs
pid Process 2880 ggkkIEYQ.exe 3372 KcQMIAgE.exe 2096 ggkkIEYQ.exe 764 KcQMIAgE.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ggkkIEYQ.exe = "C:\\Users\\Admin\\NaAwwUEE\\ggkkIEYQ.exe" 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KcQMIAgE.exe = "C:\\ProgramData\\VQMsgMUg\\KcQMIAgE.exe" 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ggkkIEYQ.exe = "C:\\Users\\Admin\\NaAwwUEE\\ggkkIEYQ.exe" ggkkIEYQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KcQMIAgE.exe = "C:\\ProgramData\\VQMsgMUg\\KcQMIAgE.exe" KcQMIAgE.exe Set value (str) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ggkkIEYQ.exe = "C:\\Users\\Admin\\NaAwwUEE\\ggkkIEYQ.exe" ggkkIEYQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KcQMIAgE.exe = "C:\\ProgramData\\VQMsgMUg\\KcQMIAgE.exe" KcQMIAgE.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe ggkkIEYQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ggkkIEYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KcQMIAgE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 4224 reg.exe 5052 Process not Found 972 reg.exe 4376 Process not Found 1436 Process not Found 2884 reg.exe 1212 reg.exe 4264 reg.exe 5044 reg.exe 4768 reg.exe 4768 reg.exe 3576 reg.exe 1448 reg.exe 2108 reg.exe 2760 reg.exe 3880 Process not Found 4604 reg.exe 4744 reg.exe 216 reg.exe 1392 reg.exe 4612 reg.exe 4208 reg.exe 964 reg.exe 556 reg.exe 1408 reg.exe 840 reg.exe 4084 reg.exe 540 reg.exe 4756 reg.exe 4372 reg.exe 2196 reg.exe 3204 reg.exe 3508 reg.exe 4060 Process not Found 3880 Process not Found 2628 reg.exe 2148 reg.exe 1264 reg.exe 1408 reg.exe 2436 reg.exe 4004 reg.exe 3332 reg.exe 4136 reg.exe 1188 reg.exe 1988 Process not Found 4992 reg.exe 4440 reg.exe 2296 Process not Found 1160 Process not Found 3332 reg.exe 2456 reg.exe 4196 reg.exe 4148 reg.exe 4220 reg.exe 1436 Process not Found 2668 reg.exe 2136 reg.exe 2776 Process not Found 2564 reg.exe 4444 Process not Found 5000 reg.exe 3744 reg.exe 3088 reg.exe 3376 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2236 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2236 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2236 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2236 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 5084 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 5084 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 5084 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 5084 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 4392 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 4392 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 4392 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 4392 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 4952 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 4952 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 4952 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 4952 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1984 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1984 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1984 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1984 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3792 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3792 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3792 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3792 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 5068 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 5068 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 5068 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 5068 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1856 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1856 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1856 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1856 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3552 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3552 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3552 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 3552 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1640 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1640 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1640 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 1640 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 448 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 448 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 448 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 448 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2136 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2136 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2136 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 2136 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe -
Suspicious use of FindShellTrayWindow 20 IoCs
pid Process 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe 2880 ggkkIEYQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4680 wrote to memory of 2880 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 88 PID 4680 wrote to memory of 2880 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 88 PID 4680 wrote to memory of 2880 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 88 PID 4680 wrote to memory of 3372 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 91 PID 4680 wrote to memory of 3372 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 91 PID 4680 wrote to memory of 3372 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 91 PID 4680 wrote to memory of 3648 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 93 PID 4680 wrote to memory of 3648 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 93 PID 4680 wrote to memory of 3648 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 93 PID 4680 wrote to memory of 1772 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 97 PID 4680 wrote to memory of 1772 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 97 PID 4680 wrote to memory of 1772 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 97 PID 4680 wrote to memory of 4876 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 98 PID 4680 wrote to memory of 4876 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 98 PID 4680 wrote to memory of 4876 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 98 PID 4680 wrote to memory of 2596 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 99 PID 4680 wrote to memory of 2596 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 99 PID 4680 wrote to memory of 2596 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 99 PID 4680 wrote to memory of 4428 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 100 PID 4680 wrote to memory of 4428 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 100 PID 4680 wrote to memory of 4428 4680 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 100 PID 3648 wrote to memory of 3576 3648 cmd.exe 105 PID 3648 wrote to memory of 3576 3648 cmd.exe 105 PID 3648 wrote to memory of 3576 3648 cmd.exe 105 PID 5048 wrote to memory of 2096 5048 cmd.exe 106 PID 5048 wrote to memory of 2096 5048 cmd.exe 106 PID 5048 wrote to memory of 2096 5048 cmd.exe 106 PID 4428 wrote to memory of 1920 4428 cmd.exe 107 PID 4428 wrote to memory of 1920 4428 cmd.exe 107 PID 4428 wrote to memory of 1920 4428 cmd.exe 107 PID 1356 wrote to memory of 764 1356 cmd.exe 108 PID 1356 wrote to memory of 764 1356 cmd.exe 108 PID 1356 wrote to memory of 764 1356 cmd.exe 108 PID 3576 wrote to memory of 4304 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 109 PID 3576 wrote to memory of 4304 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 109 PID 3576 wrote to memory of 4304 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 109 PID 4304 wrote to memory of 2260 4304 cmd.exe 111 PID 4304 wrote to memory of 2260 4304 cmd.exe 111 PID 4304 wrote to memory of 2260 4304 cmd.exe 111 PID 3576 wrote to memory of 4328 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 112 PID 3576 wrote to memory of 4328 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 112 PID 3576 wrote to memory of 4328 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 112 PID 3576 wrote to memory of 3848 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 113 PID 3576 wrote to memory of 3848 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 113 PID 3576 wrote to memory of 3848 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 113 PID 3576 wrote to memory of 4148 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 114 PID 3576 wrote to memory of 4148 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 114 PID 3576 wrote to memory of 4148 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 114 PID 3576 wrote to memory of 4396 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 115 PID 3576 wrote to memory of 4396 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 115 PID 3576 wrote to memory of 4396 3576 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 115 PID 4396 wrote to memory of 448 4396 cmd.exe 120 PID 4396 wrote to memory of 448 4396 cmd.exe 120 PID 4396 wrote to memory of 448 4396 cmd.exe 120 PID 2260 wrote to memory of 2480 2260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 121 PID 2260 wrote to memory of 2480 2260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 121 PID 2260 wrote to memory of 2480 2260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 121 PID 2480 wrote to memory of 2236 2480 cmd.exe 123 PID 2480 wrote to memory of 2236 2480 cmd.exe 123 PID 2480 wrote to memory of 2236 2480 cmd.exe 123 PID 2260 wrote to memory of 4152 2260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 124 PID 2260 wrote to memory of 4152 2260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 124 PID 2260 wrote to memory of 4152 2260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 124 PID 2260 wrote to memory of 4360 2260 2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\NaAwwUEE\ggkkIEYQ.exe"C:\Users\Admin\NaAwwUEE\ggkkIEYQ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2880
-
-
C:\ProgramData\VQMsgMUg\KcQMIAgE.exe"C:\ProgramData\VQMsgMUg\KcQMIAgE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3372
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"8⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"10⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"12⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"14⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"16⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"18⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"20⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"22⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"24⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"26⤵PID:4612
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵PID:3260
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"28⤵
- System Location Discovery: System Language Discovery
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"30⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"32⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock33⤵PID:1732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"34⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock35⤵PID:1056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"36⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock37⤵PID:1880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"38⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock39⤵PID:2064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"40⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock41⤵PID:4940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"42⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock43⤵PID:4904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"44⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock45⤵PID:3012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"46⤵PID:3736
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵PID:1032
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock47⤵PID:4756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"48⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock49⤵PID:1580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"50⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock51⤵PID:4356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"52⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock53⤵PID:216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"54⤵PID:1392
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵PID:456
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock55⤵PID:4084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"56⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock57⤵PID:2236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"58⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock59⤵PID:4952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"60⤵PID:5044
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵PID:448
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock61⤵PID:3636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"62⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock63⤵PID:3568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"64⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock65⤵PID:3880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"66⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock67⤵PID:1188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"68⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock69⤵PID:4692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"70⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock71⤵PID:3552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"72⤵
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock73⤵PID:2188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"74⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock75⤵PID:3908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"76⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock77⤵PID:4136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"78⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock79⤵PID:1580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"80⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock81⤵PID:4112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"82⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock83⤵PID:2064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"84⤵PID:432
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵PID:3636
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock85⤵PID:1640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"86⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock87⤵PID:216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"88⤵PID:3476
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:2008
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock89⤵
- System Location Discovery: System Language Discovery
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"90⤵
- System Location Discovery: System Language Discovery
PID:3468 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵PID:4516
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock91⤵PID:3616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"92⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock93⤵PID:556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"94⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock95⤵PID:4744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"96⤵
- System Location Discovery: System Language Discovery
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock97⤵PID:1104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"98⤵PID:1600
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock99⤵PID:2148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"100⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock101⤵
- System Location Discovery: System Language Discovery
PID:540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"102⤵PID:2136
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock103⤵PID:1248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"104⤵PID:676
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵PID:4604
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock105⤵
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"106⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock107⤵PID:4608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"108⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock109⤵PID:1972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"110⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock111⤵PID:5020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"112⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock113⤵PID:3092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"114⤵
- System Location Discovery: System Language Discovery
PID:4608 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:4016
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock115⤵PID:2456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"116⤵
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:1436
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock117⤵PID:4396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"118⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock119⤵
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"120⤵PID:2584
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵PID:4180
-
-
C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock121⤵PID:1456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2025-05-29_f8bf3340ea587acc2f96c24372f29edf_elex_virlock"122⤵PID:4640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-