Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 07:27
General
- Target 2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe
- Size 1.6MB
- Sample260822-h924caee52
- SHA256 85dc55357d9b7f73ccb57d1447c13f27b2f0a6938b5d30e362dcc87ae95a86bf
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 23 IoCs
- UAC bypass 3 TTPs 23 IoCs
- Renames multiple (137) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 7 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 9 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 23 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 46 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 20 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\QuIkEMkg\iwcoUQME.exe"C:\Users\Admin\QuIkEMkg\iwcoUQME.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\DgIUYsko\FGkMEQoI.exe"C:\ProgramData\DgIUYsko\FGkMEQoI.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\ProgramData\DgIUYsko\FGkMEQoI.exe"C:\ProgramData\DgIUYsko\FGkMEQoI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\QuIkEMkg\iwcoUQME.exe"C:\Users\Admin\QuIkEMkg\iwcoUQME.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"26⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"28⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"30⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock31⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"32⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock33⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock35⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock37⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"38⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"40⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"42⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"44⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock"46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IuUIUgMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""46⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mSAEEUww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mwMgksEw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RooEYwgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RckgYwMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""38⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zssUMMEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\koIEgIEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GssIMMIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eUAQcgwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ioQQIAIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""28⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FOUAEUQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NGscQEUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""24⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JEoYUkUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ciUEAAQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sgAMgAoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SEkUAQMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MUwUQYsw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bEQYgIgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""12⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XqMIscYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZYoEkEAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ckAsYEYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PMMAkQUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fmoAEsQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock.exe""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\hicQgYQk\YwwgkwUE.exeC:\ProgramData\hicQgYQk\YwwgkwUE.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\QuIkEMkg\iwcoUQME.exeC:\Users\Admin\QuIkEMkg\iwcoUQME.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\DgIUYsko\FGkMEQoI.exeC:\ProgramData\DgIUYsko\FGkMEQoI.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
FGkMEQoI.exe
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
FGkMEQoI.inf
JyEk.txt
YwwgkwUE.exe
2026-08-21_b6bcf1953853b64de6d01a293d108f6f_elex_virlock
AEgW.exe
AEwC.exe
AMga.exe
AMwU.exe
AUMy.exe
AUUo.exe
Agcq.exe
CIQK.exe
CkMi.exe
CkgS.exe
EAAG.exe
EEMK.exe
EIYG.exe
EcQO.exe
EkAs.exe
Eqko.ico
GUYe.exe
GYsw.exe
GeQY.ico
Gkgm.exe
Gkow.exe
GoMy.exe
GoUY.ico
GooA.exe
Gsca.exe
GwEs.exe
Gwcs.exe
IAMW.exe
IMIi.exe
IMog.exe
ISgY.ico
IYYa.exe
IYcY.exe
IYkg.exe
IeQs.ico
IswA.exe
Iuws.ico
IwQk.exe
KAkM.exe
KMYK.exe
KMwM.exe
KUsy.exe
KYAu.exe
KgIk.exe
KoIE.ico
KsEq.exe
MAIY.exe
MgUU.exe
OEoe.exe
OIoo.exe
OgEM.exe
OkwI.exe
Oocu.exe
Oooq.exe
OsMY.exe
PMMAkQUg.bat
QMgi.exe
QQsI.exe
QUgk.exe
QUsW.exe
QYIW.exe
QcgQ.exe
SAcK.exe
SEkU.exe
SUEK.exe
SUka.exe
SsMQ.exe
SwcM.exe
UMUi.exe
UQoQ.exe
UUcs.exe
UUgQ.exe
UUwS.exe
UYIU.exe
UYsI.exe
UgAG.exe
UksM.exe
WMMi.exe
WgQU.exe
Wgka.exe
WogG.exe
WosW.exe
WsEA.ico
WsYm.exe
YQYs.exe
YgMM.exe
YkQY.exe
Ykws.exe
YooI.exe
YsoQ.exe
YwQS.exe
aEEC.exe
aIgM.exe
aKQs.ico
aMMQ.exe
aQQk.exe
acAk.exe
agwm.exe
asoQ.exe
awwk.exe
cQMM.exe
cUog.exe
coEM.ico
ecog.exe
ekEo.exe
ewkO.exe
file.vbs
gAMC.exe
gAMo.exe
gAoA.exe
gQIU.exe
gQgc.exe
gUkA.exe
goMA.exe
iAco.exe
iMom.exe
iUAk.exe
iYsO.exe
ikIY.exe
ioYw.exe
isoO.exe
kAAy.exe
kUQk.exe
kkYC.exe
kowo.exe
kwAk.exe
kwgG.exe
mIke.exe
mYAA.exe
miQE.ico
moku.exe
oIck.exe
oIwS.exe
oUse.exe
ocQo.exe
ogoY.ico
okYA.exe
owwo.exe
qcga.exe
qkUO.exe
qkcw.exe
qsoQ.ico
sQEY.exe
sUAi.exe
sYMe.exe
sgsA.exe
skgS.exe
socW.exe
ssUQ.exe
swMa.exe
uAoW.exe
uYom.exe
uggA.exe
ukUC.exe
wIgq.exe
wMIE.exe
wYgA.exe
wcMi.exe
wcws.exe
wogy.exe
yAsO.exe
yEco.exe
yEoQ.ico
yMQQ.exe
yQoS.exe
yUcg.ico
ycMe.exe
ycMw.exe
ygEA.exe
ykQs.exe
ysQC.exe
ysQU.exe
iwcoUQME.exe
iwcoUQME.inf
iwcoUQME.inf
iwcoUQME.inf
iwcoUQME.inf
iwcoUQME.inf
iwcoUQME.inf
iwcoUQME.inf
iwcoUQME.inf
iwcoUQME.inf
iwcoUQME.inf
iwcoUQME.inf
memory/432-95-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1012-234-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1148-136-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1356-308-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1544-81-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1544-63-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1636-122-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2168-2427-0x0000000000400000-0x0000000000591000-memory.dmp
memory/2240-286-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2304-2393-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2304-7-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2304-325-0x0000000000760000-0x0000000000780000-memory.dmp
memory/2304-2139-0x0000000000760000-0x0000000000780000-memory.dmp
memory/2948-67-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3056-166-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3272-180-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3344-45-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3356-245-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3472-2603-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4092-255-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4148-223-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4192-2414-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4332-274-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4404-211-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4484-194-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4860-265-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4944-152-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4972-296-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5072-32-0x0000000002210000-0x0000000002230000-memory.dmp
memory/5072-1-0x0000000002210000-0x0000000002230000-memory.dmp
memory/5072-0-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5072-31-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5584-18-0x0000000000400000-0x0000000000591000-memory.dmp
memory/5584-2400-0x0000000000400000-0x0000000000591000-memory.dmp
memory/5788-110-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5816-2407-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5816-21-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5848-317-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5848-304-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5856-2596-0x0000000000400000-0x0000000000591000-memory.dmp