Analysis
- max time kernel
150s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/08/2026, 12:33
General
- Target 2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe
- Size 1.6MB
- Sample260824-prphvsxfrd
- SHA256 46746c30a1150018bdd6c886340e01ddf0dc0a2f9160bddd12f91ed126dbfa2c
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 40 IoCs
- UAC bypass 3 TTPs 40 IoCs
- Renames multiple (155) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 7 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 40 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 17 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\GkEoIgkE\LEwcEQsQ.exe"C:\Users\Admin\GkEoIgkE\LEwcEQsQ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\aMgkIIAA\NgoowYoE.exe"C:\ProgramData\aMgkIIAA\NgoowYoE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock13⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV117⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"20⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"22⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"24⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"26⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"28⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"30⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock31⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"34⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"36⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"40⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock43⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"44⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock45⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"46⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"48⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock51⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock53⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"56⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"58⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"62⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"64⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock65⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"66⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock71⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"72⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"74⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"78⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock"80⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QoIAMsIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""80⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EeQQIMcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""78⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AMcgEUQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""76⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qSYgAMMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XKgwQokE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""72⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tqsMYMgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""70⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uqgsIMMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""68⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tEwcoUEw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""66⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IiEsoMcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""64⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zmgcokEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SUIMsQIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YoQEYkAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""58⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BWQwYgQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""56⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WAsIgQsI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UGAMoQsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HmscoQkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tUQUgwok.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cqoowQYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""46⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xIMIIcQU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""44⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\umMIwQwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\deUkAIkQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""40⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\woUowYcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""38⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BugwcoYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""36⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gEoYYIck.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""34⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZAsAYQwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""32⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VskkEEsI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""30⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dgUUgMYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""28⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WWQkUcAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SGggAYEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PScAoIMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XcEAQwgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lcIwYMMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""18⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kqMcscMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\awEwAIYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kGMkgMoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NgUkAIkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pkgcwsQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iqgskscU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kyUgoMsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HgwcMoUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock.exe""2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\ProgramData\twgwwkEA\wEIEwAkw.exeC:\ProgramData\twgwwkEA\wEIEwAkw.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\GkEoIgkE\LEwcEQsQ.exeC:\Users\Admin\GkEoIgkE\LEwcEQsQ.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\aMgkIIAA\NgoowYoE.exeC:\ProgramData\aMgkIIAA\NgoowYoE.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
vcredist_x86.exe
RuAc.txt
NgoowYoE.exe
NgoowYoE.inf
NgoowYoE.inf
NgoowYoE.inf
NgoowYoE.inf
NgoowYoE.inf
wEIEwAkw.exe
64.png.exe
2026-08-23_4908987a8e955738fd552b94e9e64df1_elex_virlock
AAAe.exe
AAww.exe
AMEO.exe
AMEq.exe
AUcW.exe
AkQG.exe
AwEY.exe
CAoQ.exe
CIgW.exe
CMAG.exe
Coow.exe
CsAE.exe
EAIE.exe
EAMa.exe
EIIK.exe
EYEC.exe
EYYg.exe
EcUO.exe
EkYw.exe
Eosu.exe
EsEO.exe
EwQS.exe
GAYw.exe
GIUA.exe
GIwm.exe
GUAC.exe
GcUQ.exe
Gcoi.exe
Gwgm.exe
HgwcMoUg.bat
IAMA.exe
IEYa.exe
IMwY.exe
IcEq.exe
KAcm.exe
KIMQ.exe
KMAe.exe
KMUs.exe
KUoW.exe
KYgO.exe
KuUo.ico
KwsI.exe
KwsY.exe
MEsw.ico
MMgM.exe
MQMC.exe
MQoI.exe
MkQa.exe
MoIg.exe
MsEO.exe
MwwS.exe
OEQA.exe
OIUg.ico
OQAa.exe
OUEO.exe
OUQs.exe
OkUO.exe
OsYE.exe
OsYu.exe
QIoC.exe
QMQo.exe
QYgq.exe
QoAW.exe
QsAq.exe
QsMC.exe
Qssw.ico
QwMM.ico
SAkQ.exe
SKkA.ico
SMQo.exe
SYYe.exe
SgQk.exe
Sgkm.exe
SgsQ.exe
SkUo.exe
Skok.exe
SoYI.exe
SwAs.exe
SwYS.exe
UAMQ.exe
UAQu.exe
UAss.exe
UAwG.exe
UMgi.exe
UQQg.exe
UUQk.exe
UcYy.exe
UgAM.exe
WAAS.exe
WYwQ.exe
WkAm.exe
WkIY.exe
WsYI.exe
YAwk.exe
YGsc.ico
YIEu.exe
YMwQ.exe
YQIM.exe
YQoE.exe
YoQS.exe
YscM.exe
YsgA.ico
aAUy.exe
aYgQ.exe
agYo.exe
akYa.exe
aoUk.exe
aooS.exe
awok.exe
cIwi.exe
cUYe.exe
cUgY.exe
cYIs.exe
ceow.ico
cgAy.exe
cgoa.exe
cgwQ.exe
coEI.ico
csEC.exe
cswK.exe
eAkC.exe
eAoQ.exe
eEMO.exe
eEQM.exe
eEYA.exe
eGkg.ico
eIES.exe
ecgE.exe
eoku.exe
file.vbs
gAsM.exe
gIEa.exe
gKIQ.ico
gskY.exe
iAAc.exe
iEoE.exe
iMAG.exe
iMkG.exe
iYMa.exe
igMo.exe
iwcI.exe
kEUa.exe
kIUa.exe
kMEm.exe
kMkk.exe
kQIs.exe
kikA.ico
kkgU.exe
kkkk.exe
koIS.exe
kogU.exe
mIwo.exe
mkMI.exe
mwUa.exe
oAYM.exe
oYES.exe
okEw.exe
okIQ.exe
ooAU.exe
ooAW.exe
osIc.exe
qIYO.exe
qYsg.exe
qcEW.exe
qcoM.exe
qkIm.exe
qkoM.exe
sMQQ.exe
sQUY.exe
skQc.exe
soks.exe
uEcy.exe
uMcu.exe
uUAg.exe
usUM.exe
usgE.exe
uwMe.exe
wEos.exe
wEou.exe
wKgc.ico
wUgU.exe
wccU.exe
wkcC.exe
wosq.exe
wsAs.ico
wwcU.exe
yQEs.exe
yUQk.ico
yYAM.exe
ygsw.exe
ykEI.exe
yokQ.exe
yswA.exe
ywcu.exe
PingUpdate.doc.exe
SubmitGrant.docx.exe
LEwcEQsQ.exe
LEwcEQsQ.inf
memory/520-617-0x0000000000400000-0x0000000000592000-memory.dmp
memory/520-683-0x0000000000400000-0x0000000000592000-memory.dmp
memory/740-77-0x0000000000400000-0x0000000000592000-memory.dmp
memory/740-61-0x0000000000400000-0x0000000000592000-memory.dmp
memory/764-1667-0x0000000000400000-0x0000000000592000-memory.dmp
memory/764-1615-0x0000000000400000-0x0000000000592000-memory.dmp
memory/872-228-0x0000000000400000-0x0000000000592000-memory.dmp
memory/872-221-0x0000000000400000-0x0000000000592000-memory.dmp
memory/948-2151-0x0000000000400000-0x0000000000592000-memory.dmp
memory/948-2234-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1188-346-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1188-304-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1216-129-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1216-147-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1404-27-0x00000000006E0000-0x0000000000700000-memory.dmp
memory/1404-0-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1404-1-0x00000000006E0000-0x0000000000700000-memory.dmp
memory/1404-26-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1488-512-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1488-562-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1580-53-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1580-60-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1688-132-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1688-121-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1720-262-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1720-254-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2028-117-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2028-103-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2108-2212-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2108-2260-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2176-90-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2176-80-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2244-100-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2564-170-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2564-158-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2700-208-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2836-1689-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2836-1746-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3040-1937-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3040-1884-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3088-1434-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3088-1376-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3132-2814-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3132-11-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3132-239-0x0000000002090000-0x00000000020B0000-memory.dmp
memory/3132-697-0x0000000002090000-0x00000000020B0000-memory.dmp
memory/3232-921-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3232-1003-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3248-1835-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3248-1776-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3388-779-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3388-705-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3412-219-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3412-209-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3460-185-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3460-201-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3524-355-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3524-410-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3628-232-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3628-255-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3728-161-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3820-2025-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3820-1962-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3840-1472-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3840-1499-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4120-40-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4120-2846-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4248-18-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4248-2828-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4340-1363-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4340-1261-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4380-28-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4380-43-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4436-188-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4436-173-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4552-2076-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4552-2133-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4568-527-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4568-459-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4648-1590-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4648-1532-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4660-32-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4660-2841-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4716-808-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4716-895-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4724-1107-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4724-1049-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4736-2823-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4736-12-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4752-1148-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4752-1195-0x0000000000400000-0x0000000000592000-memory.dmp