Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 03:03
General
- Target 2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe
- Size 1.6MB
- Sample260806-dkc1pscn8t
- SHA256 26da5c516473001f1b3f78e352bc941e04badbc97bda94f518ce0f9dee407859
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 59 IoCs
- UAC bypass 3 TTPs 59 IoCs
- Renames multiple (112) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 8 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 58 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 21 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\FiEsMMgY\cKoIYkAo.exe"C:\Users\Admin\FiEsMMgY\cKoIYkAo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\WEgAogMI\LcowEQgs.exe"C:\ProgramData\WEgAogMI\LcowEQgs.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\ProgramData\WEgAogMI\LcowEQgs.exe"C:\ProgramData\WEgAogMI\LcowEQgs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock21⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"22⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"24⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"26⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock31⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"34⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"36⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"38⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"48⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock51⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"52⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"56⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock59⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"62⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"64⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"68⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"70⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock71⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"72⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"74⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"76⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"80⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"86⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock87⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"88⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"92⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"96⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"98⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"100⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"106⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"108⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock109⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"110⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"112⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"114⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock"116⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock117⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2118⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f118⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2116⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f116⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vsIwUAUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""116⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs117⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2114⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f114⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OSMUgwgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""114⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs115⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1112⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2112⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f112⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oSkwcUIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""112⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs113⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1110⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2110⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f110⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aEAIcUQY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""110⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs111⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1108⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2108⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f108⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dqkQgYgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs109⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jcIMgAIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""106⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs107⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MiYooMYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""104⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cwAckMUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""102⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CqsYogsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""100⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IkQcwMUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""98⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nCsMkwUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""96⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\joYkwwgU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""94⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RuQwUIQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""92⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OOUUkkUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""90⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sSYAgQog.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""88⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zycIQMUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""86⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TwcgkUkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""84⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LywkccgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""82⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qswUkssQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""80⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KYUAUEAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""78⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KuYMscsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""76⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foUsIwkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""74⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JyokEUIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""72⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QwwAQkoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""70⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yGgccAQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""68⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AqEEcAco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jCgAwEMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XgoUUAQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""62⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PmEQcscI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""60⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YCEQggMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""58⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\scwIAkMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xqgAQsAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""54⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pQQEgkAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""52⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KgksYggw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""50⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AuAkYMMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""48⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mcAIgIAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""46⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SmgwgEwg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""44⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yYMIYEsw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xgIIkYkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pmEQwQcc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uiAUsgUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""36⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QIUQEEIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jUMEAUgg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""32⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bGUEEogI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""30⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qowEowcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""28⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oOgoIAcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QyogEAoY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""24⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zqkYAMUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jeAgUosk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""20⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nKMIUMcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""18⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jokYUkcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gassMgYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CsAUEoUU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jkAIoMIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RwAYYEcE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DuIwAkIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OgIkEMIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EYIkgkYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\ProgramData\xkwEYEwE\TqskMowY.exeC:\ProgramData\xkwEYEwE\TqskMowY.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\ProgramData\WEgAogMI\LcowEQgs.exeC:\ProgramData\WEgAogMI\LcowEQgs.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\FiEsMMgY\cKoIYkAo.exeC:\Users\Admin\FiEsMMgY\cKoIYkAo.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv +Db6bMKU/kCXE7HRUHu0Yw.0.21⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
UOYE.txt
LcowEQgs.exe
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
LcowEQgs.inf
TqskMowY.exe
2026-08-06_b7ce5cdcc1e4a08920a6b4eb0ca39811_elex_virlock
AIwg.exe
AQYK.exe
AUoG.exe
AgkE.exe
AgwU.exe
CAgu.exe
CAoe.exe
CcMS.exe
Ccca.exe
CoAe.exe
CscQ.exe
EAsk.exe
EAwm.exe
EUAQ.exe
EYIkgkYc.bat
Emoo.ico
EssU.exe
EwUw.exe
GoMY.exe
GwkC.exe
GwoE.exe
IIAc.exe
IMEM.exe
IQQY.exe
IWEg.ico
IYwY.exe
IcEq.exe
IcsY.exe
IoIG.exe
Kcws.exe
KgUy.exe
KgoG.exe
KgwK.exe
Kkwk.exe
MUMg.exe
MYsS.exe
Mgcq.exe
Mgow.exe
MkIG.exe
OAgS.exe
OMUC.exe
OQcs.exe
OUYK.exe
OUoS.exe
OUwW.exe
OYMU.exe
OiUQ.ico
OkEs.exe
OqwI.ico
QIAG.exe
QIoS.exe
QUIU.exe
QgcW.exe
QkQw.exe
QoEI.exe
Qsgg.exe
SMUw.exe
SYYO.exe
SccO.exe
SskO.exe
UMwy.exe
UUMK.exe
UgIW.exe
UwwS.exe
WAkk.exe
WIQc.exe
WMQA.exe
WQAq.exe
WYAA.ico
WYsM.exe
WcwY.exe
WkcC.exe
Wwko.exe
YAwq.exe
YIYi.exe
YWgc.ico
YYsG.exe
YcAw.exe
YgAQ.exe
YgEC.exe
Ykku.exe
Yowq.exe
YsoE.exe
YwUu.exe
aEYm.exe
aIgO.exe
aMIG.exe
aYUm.exe
agsa.exe
asAY.exe
cUoQ.ico
cksc.exe
ckso.exe
cswk.exe
cwcu.exe
eeYY.ico
egoI.ico
ekoM.exe
file.vbs
gooK.exe
gsAq.exe
iUEA.exe
iUIo.exe
kIsa.exe
kQAc.exe
kUQu.exe
kUkC.exe
kUsS.exe
kgYO.exe
mAIw.exe
mAMk.exe
mAse.exe
mQEk.exe
mgAO.exe
mgMG.exe
oAMg.exe
oQsm.exe
oYsk.exe
ogQi.exe
qEUG.exe
qIUq.exe
qUEe.exe
qcgk.exe
sEAE.exe
sYoa.exe
scQS.exe
ssAS.exe
ssYI.exe
uIMs.exe
uMgi.exe
uQAG.exe
uYsS.exe
ugEq.exe
ussw.exe
wEUo.exe
wUgs.exe
wYYG.exe
wgAa.exe
wsYq.exe
yIAW.exe
yKck.ico
yMAE.exe
yYsK.exe
ycce.exe
cKoIYkAo.exe
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
cKoIYkAo.inf
memory/200-2175-0x0000000000400000-0x0000000000598000-memory.dmp
memory/584-186-0x0000000000400000-0x0000000000598000-memory.dmp
memory/624-2298-0x0000000000400000-0x000000000058F000-memory.dmp
memory/624-19-0x0000000000400000-0x000000000058F000-memory.dmp
memory/940-248-0x0000000000400000-0x0000000000598000-memory.dmp
memory/992-2134-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1060-2045-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1404-2023-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1724-1991-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1724-1981-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1872-2014-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1924-2000-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2008-214-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2040-1924-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2432-198-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2472-108-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2568-1934-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2632-1944-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2688-2033-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2856-2070-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2872-153-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2900-1879-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2904-1868-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3024-257-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3060-0-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3060-32-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3060-33-0x00000000041A0000-0x00000000041C0000-memory.dmp
memory/3060-1-0x00000000041A0000-0x00000000041C0000-memory.dmp
memory/3172-2121-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3404-172-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3424-2162-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3608-96-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3764-2185-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3816-2310-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3924-1956-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3924-1940-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3940-2089-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4112-1901-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4160-351-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4216-2292-0x0000000000400000-0x000000000058F000-memory.dmp
memory/4216-16-0x0000000000400000-0x000000000058F000-memory.dmp
memory/4344-1976-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4344-1964-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4368-304-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4456-1846-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4572-1892-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4620-461-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4700-2111-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4832-1911-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4852-2460-0x0000000000400000-0x000000000058F000-memory.dmp
memory/4860-80-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4876-51-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4928-129-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5024-279-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5088-270-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5128-226-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5248-2198-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5324-2143-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5352-1968-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5432-2304-0x0000000000400000-0x000000000058F000-memory.dmp
memory/5440-239-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5604-2102-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5692-403-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5704-141-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5724-1284-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5748-63-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5868-1869-0x00000000021E0000-0x0000000002200000-memory.dmp
memory/5868-2286-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5868-7-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5868-283-0x00000000021E0000-0x0000000002200000-memory.dmp
memory/5928-2079-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5968-2153-0x0000000000400000-0x0000000000598000-memory.dmp
memory/6032-1855-0x0000000000400000-0x0000000000598000-memory.dmp
memory/6076-2057-0x0000000000400000-0x0000000000598000-memory.dmp
memory/6076-2046-0x0000000000400000-0x0000000000598000-memory.dmp