Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 12:35
General
- Target 2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe
- Size 1.6MB
- Sample260809-psa2vs1th1
- SHA256 6d8850de6b77b8dfd65d512f612d498c5ed60dc8f7eccbe9f2ad3e1746cc1154
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 52 IoCs
- UAC bypass 3 TTPs 52 IoCs
- Renames multiple (165) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 8 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 10 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 51 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 18 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\COAcggMU\bGAoIQgY.exe"C:\Users\Admin\COAcggMU\bGAoIQgY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\IEEIEQss\EcAEcskM.exe"C:\ProgramData\IEEIEQss\EcAEcskM.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\ProgramData\IEEIEQss\EcAEcskM.exe"C:\ProgramData\IEEIEQss\EcAEcskM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\COAcggMU\bGAoIQgY.exe"C:\Users\Admin\COAcggMU\bGAoIQgY.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock9⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock13⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"16⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock19⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"20⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"22⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"24⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"36⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"38⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock39⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"40⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"42⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"44⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"48⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"52⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"58⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"60⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"62⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"64⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock67⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"68⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"70⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"72⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock75⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock77⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"78⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"80⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"82⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"84⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock85⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"86⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"88⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"90⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock91⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"92⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"98⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock99⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"100⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock"102⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock103⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cIgIYwos.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""102⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HMkowsIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\twsUkkwY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""98⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jgYsoAgg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""96⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mMwEEEYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""94⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uAQAwMYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""92⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MyoQQcoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""90⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kSgQYYYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""88⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vIsMkwUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""86⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nokcQgAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LaAwgQMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""82⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aqckYkIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""80⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ECUgYEww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""78⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoEccMUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""76⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rkcoUIoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""74⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MUcgIcoQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""72⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uAkEUsoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GkIYIwUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""68⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jIQcUogs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""66⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\boMMEQQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""64⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eqAwMkQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""62⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WWgsckoM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BYYcYAIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""58⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xAQkMYQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""56⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qGoMsUcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yEAIQUEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""52⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PaEsQosw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""50⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rUAcQkQY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""48⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tqwsUcks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""46⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oAYUIgME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""44⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\deIoIcMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CuckksIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""40⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NycYwQAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""38⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZisQAMcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GkYcswQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KqsMkUcY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NaIEYEUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HCkoIogA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""28⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GCcUYQcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pUwYkYEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""24⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TWokMYIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QIoMYwkE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aCQAQYAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AsQoEUoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lMIIocoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lkokwwIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cwUQMQYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CisQYAkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vQAwIAEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\isosAkUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yCMkMgUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock.exe""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\ProgramData\AqQwogQg\zkYYgMAU.exeC:\ProgramData\AqQwogQg\zkYYgMAU.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\COAcggMU\bGAoIQgY.exeC:\Users\Admin\COAcggMU\bGAoIQgY.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\IEEIEQss\EcAEcskM.exeC:\ProgramData\IEEIEQss\EcAEcskM.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\COAcggMU\bGAoIQgY.exe"C:\Users\Admin\COAcggMU\bGAoIQgY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
zkYYgMAU.exe
DGsY.txt
EcAEcskM.exe
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
EcAEcskM.inf
vcredist_x86.exe
2026-08-09_641e9505f82532ef1f83db6720c90e00_elex_virlock
BEAu.exe
BEcu.exe
BUgq.exe
BcsU.exe
BikU.ico
BkMk.ico
BsME.exe
BswS.exe
BwQI.exe
DAIm.exe
DIcG.exe
DYgw.exe
DYkI.exe
DYkU.exe
Dckk.exe
DogQ.exe
FMkI.exe
FMoy.exe
FQoQ.exe
FUYI.ico
FogE.ico
HAIO.exe
HIIo.exe
HIcG.exe
HQAM.exe
HQwG.exe
HYES.exe
Hsoi.exe
HwYW.exe
JEsK.exe
JMkM.exe
JcsC.exe
JgYK.exe
JgYe.exe
JgwU.exe
JkIe.exe
JsAk.exe
JsgK.exe
LAIy.exe
LAMU.exe
LIMg.exe
LOcQ.ico
LcoK.exe
LkIq.exe
Lkwq.exe
LsIw.exe
LwME.exe
NAMg.exe
NEQa.exe
NgIe.exe
NskI.exe
PAQA.exe
PAki.exe
PaUg.ico
PcYC.exe
Pwsw.exe
REkU.exe
RkoC.exe
TAUU.exe
TAkA.exe
TQcS.exe
TYAg.exe
TYQo.exe
Tkcc.exe
TkgY.exe
ToQw.exe
TwcY.exe
VEME.exe
VEMi.exe
VIkQ.exe
VcQk.exe
Vcwo.exe
VgMO.exe
VoMm.exe
VskY.exe
VwgS.exe
XAgC.exe
XEMs.exe
XMEU.exe
XMIC.exe
XYsc.exe
XeAM.ico
XkMo.exe
Xkca.exe
XoUS.exe
XsUC.exe
ZAIW.exe
ZEkA.ico
ZIYu.exe
ZMoe.exe
ZYYW.exe
ZYcc.ico
ZsEg.exe
bAMq.exe
bIIg.exe
bIMs.exe
bIcC.exe
bIwU.exe
bUMO.exe
bUYs.exe
bcYm.exe
dIYM.exe
dccg.exe
dscy.exe
fAAY.exe
fAcg.exe
fUcO.exe
fYUG.exe
fcAq.exe
fgoE.exe
file.vbs
fkMc.exe
fuII.ico
hAom.exe
hIwY.exe
hYEm.exe
hkMA.exe
hogg.exe
hycc.ico
jAQe.exe
jAog.exe
jIYc.exe
jMUG.exe
jMcM.exe
jUUm.exe
jUcY.exe
jYoc.exe
jcwM.exe
jgwm.exe
jkkW.exe
lAIw.exe
lEII.exe
lIcW.exe
lMAI.exe
lQMY.exe
lQgE.exe
lcwA.exe
lgMq.exe
lgUo.exe
lgYE.exe
lkQO.exe
lsMs.exe
lyEc.ico
nIEW.exe
nMAS.exe
nMIQ.exe
nQAI.exe
nUMu.exe
nYUO.exe
nYUU.exe
nkcM.exe
nwIM.exe
nwsG.exe
pEcw.exe
pMEQ.exe
pMwM.exe
pUMY.exe
poYQ.exe
pwki.exe
rAMC.exe
rAYE.exe
rAkG.exe
rAwc.exe
rMkq.exe
rYYe.exe
rkQe.exe
rkwg.exe
rmkY.ico
rucY.ico
tEkm.exe
tIUa.exe
tQcA.exe
tYUG.exe
tgEC.exe
tgIU.ico
tgUi.exe
toMk.exe
tooq.exe
twQo.exe
twcK.exe
vAMQ.exe
vAgq.exe
vEUs.exe
vcUI.exe
vgUy.exe
vkAk.exe
vkMu.exe
vkYO.exe
vskg.exe
vswI.exe
xAsa.exe
xMAi.exe
xYgI.exe
xgYI.exe
xogE.exe
xsAk.exe
yCMkMgUY.bat
zAwu.exe
zIAu.exe
zIsw.exe
zQks.exe
zUYs.exe
zkgo.exe
zwEC.exe
bGAoIQgY.exe
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
bGAoIQgY.inf
FormatHide.jpg.exe
memory/820-2843-0x0000000000400000-0x0000000000598000-memory.dmp
memory/820-2851-0x0000000000400000-0x0000000000598000-memory.dmp
memory/928-335-0x0000000000400000-0x0000000000598000-memory.dmp
memory/928-290-0x0000000000400000-0x0000000000598000-memory.dmp
memory/968-481-0x0000000000400000-0x0000000000598000-memory.dmp
memory/968-531-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1000-767-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1000-709-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1072-2807-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1072-2800-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1120-430-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1120-387-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1444-28-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1444-37-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1764-43-0x0000000000400000-0x0000000000591000-memory.dmp
memory/1892-2784-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1892-2776-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1916-2680-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1916-1212-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1940-2830-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1940-2842-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2256-228-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2256-238-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2284-2854-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2284-2862-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2332-185-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2332-176-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2432-206-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2432-229-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2600-2881-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2720-53-0x0000000000400000-0x0000000000591000-memory.dmp
memory/2764-7-0x0000000000400000-0x0000000000591000-memory.dmp
memory/2908-1000-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2908-2677-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3052-118-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3052-107-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3208-2732-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3208-2742-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3296-157-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3296-146-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3300-723-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3300-665-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3360-131-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3360-145-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3368-947-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3368-904-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3612-18-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3704-1-0x0000000002090000-0x00000000020B0000-memory.dmp
memory/3704-26-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3704-27-0x0000000002090000-0x00000000020B0000-memory.dmp
memory/3704-0-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3712-2785-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3712-2797-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3860-58-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3860-39-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3964-626-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3964-573-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4088-879-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4088-832-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4144-2765-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4144-2750-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4464-175-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4464-161-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4604-12-0x0000000000400000-0x0000000000591000-memory.dmp
memory/4716-74-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4716-60-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4752-205-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4752-192-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4960-87-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4960-100-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4964-2708-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4964-2720-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5028-75-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5028-86-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5092-129-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5092-115-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5192-2753-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5192-2744-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5216-2730-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5216-2723-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5220-2775-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5220-2766-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5312-2692-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5312-2682-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5356-2874-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5808-2819-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5808-2828-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5820-2859-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5820-2873-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5844-2808-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5844-2820-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5860-2693-0x0000000000400000-0x0000000000591000-memory.dmp
memory/5872-2694-0x0000000000400000-0x0000000000591000-memory.dmp
memory/5956-2696-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5956-2707-0x0000000000400000-0x0000000000598000-memory.dmp
memory/6064-2700-0x0000000000400000-0x0000000000591000-memory.dmp