Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
25/10/2026, 03:58
General
- Target 2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe
- Size 1.6MB
- Sample261025-ejf7eadz2w
- SHA256 fbc3e42f696f71e9cd81e6a8fa7b629cb2b997519212d69a1e7a075b5272b6d3
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 47 IoCs
- UAC bypass 3 TTPs 47 IoCs
- Renames multiple (176) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 7 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 47 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 17 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\aYQsMcQE\VyYIoYcE.exe"C:\Users\Admin\aYQsMcQE\VyYIoYcE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
-
C:\ProgramData\tOIQIgEg\AygkoEsg.exe"C:\ProgramData\tOIQIgEg\AygkoEsg.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"14⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock15⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock17⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"20⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"24⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"30⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"36⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock37⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"38⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"40⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"44⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock45⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock51⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock55⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"56⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"58⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"62⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"66⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock67⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock69⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock71⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"72⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock73⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"74⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"76⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"78⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"80⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock83⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"84⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"86⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock87⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"88⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"92⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock"94⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QkQoEMkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""94⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PssgcgUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""92⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OYsggMwI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""90⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PWgscYEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aYwEoIYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""86⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YqIQsYgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""84⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VEcEwMYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""82⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SMwUQMcE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""80⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fusYMkws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""78⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EQsEUgso.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""76⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yUgcEUow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NSwAsAME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iUwkIwEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""70⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JUYEoEAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yIIYgYsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""66⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BwUkksEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YOMkAEUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OawkscAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jGgsUYkE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mUkEoUgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""56⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XAwQgYUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""54⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qIsMIYMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""52⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eAMokoAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""50⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tCgUggMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kIEgAUMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yMgsYgAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""44⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rAYQEIAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\POIkQgEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MyAwkQcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\scgwkEcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""36⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NEwAsQgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TwcgAMAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""32⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fAcAcYEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""30⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KmkksYQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""28⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sWEYkEkE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cWQgcwUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""24⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\neUYkYUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LuAkkkws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""20⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iswYwMEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""18⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GYsEUwQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OykEIkIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PmIoQoMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xCYQcssQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ACEMwAUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ueYQkEUU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DcYEgoYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ecEgIwgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock.exe""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\iEwYUkMU\oUEYcogU.exeC:\ProgramData\iEwYUkMU\oUEYcogU.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\aYQsMcQE\VyYIoYcE.exeC:\Users\Admin\aYQsMcQE\VyYIoYcE.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
C:\ProgramData\tOIQIgEg\AygkoEsg.exeC:\ProgramData\tOIQIgEg\AygkoEsg.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
oUEYcogU.exe
kIwc.txt
AygkoEsg.exe
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
AygkoEsg.inf
2026-10-24_e4e2de19e3dd75f428e956b06bd9b8bd_elex_virlock
AAcq.exe
AAom.exe
AIMo.exe
AIQs.exe
AQkc.ico
AUcS.exe
AcgQ.exe
AgUC.exe
Agcg.exe
AosE.exe
Aqss.ico
AwMU.exe
AwoW.exe
CAQw.exe
CCwI.ico
CIYO.exe
CUUW.exe
CYES.exe
CYoY.exe
CYom.exe
Ckoi.exe
Cwsq.exe
DcYEgoYI.bat
EAwA.exe
EMwY.exe
EcQE.exe
Eccm.exe
EgMs.exe
EgQe.exe
Eggs.exe
Egko.exe
EoUy.exe
Eoso.exe
Eyow.ico
GEEE.exe
GQYG.exe
GUYy.exe
GUcs.exe
GgIU.exe
GgcQ.exe
GkIM.exe
GkcA.exe
IAcO.exe
IIcy.exe
IMQe.exe
IOUo.ico
IQYU.exe
IQco.exe
IYca.exe
IkoE.exe
Iooi.exe
KMwG.exe
KQIk.exe
KUQW.exe
KYcq.exe
KcQO.exe
MAYs.exe
MIUU.exe
MMsK.exe
MYUw.exe
Mgwa.exe
OEIS.exe
OIgm.exe
OMQa.exe
OQYw.exe
OkIu.exe
Oscs.exe
QAEU.exe
QMQO.exe
QMcg.exe
QMga.exe
QUYG.exe
QcsU.exe
QiEw.ico
QkYO.exe
QogW.exe
QwUu.exe
SEok.exe
SMoE.exe
SQIk.exe
SQUG.exe
SYkO.exe
ScIA.exe
ScsQ.exe
ScwM.exe
SeUs.ico
SkYy.exe
SoEi.exe
Socc.exe
SogY.exe
SqwE.ico
UMUk.exe
UMwQ.exe
UQMM.exe
UYcs.exe
UkQa.exe
UwIo.exe
WEEI.exe
WEwI.exe
WIko.exe
WMky.exe
WUww.exe
WcsK.exe
WkkA.exe
WuIg.ico
WwEU.exe
WwwI.exe
YAEA.exe
YEMQ.exe
YEQa.exe
YEcG.exe
YUkC.exe
YcYW.exe
Ykse.exe
Yogw.exe
YwwK.exe
aQko.exe
aQkw.exe
aYEq.exe
accK.exe
agwu.exe
aoMO.exe
aswc.exe
cAYG.exe
cEAa.exe
cIcu.exe
cMgo.exe
cQsS.exe
cYMs.exe
caQw.ico
coII.exe
coUo.exe
csIU.exe
eMEc.exe
eYkI.exe
egAu.exe
esoq.exe
ewIq.exe
file.vbs
gEUw.exe
gGgM.ico
gMow.exe
gQAe.exe
gUQo.exe
goEk.exe
gokk.exe
gowA.exe
gowk.exe
gscC.exe
iEUM.ico
iEsQ.exe
iMgQ.exe
iQQE.exe
iUoC.exe
iUoe.exe
iUog.exe
ikEe.exe
iocA.exe
iska.exe
iwQG.exe
kEQG.exe
kIMw.exe
kIsU.exe
kMYU.exe
kMsU.exe
kUEW.exe
kWwI.ico
kwMs.exe
kwUc.exe
mEEI.ico
mIoq.exe
mUAE.exe
moAm.exe
moco.ico
mogU.exe
mskw.ico
oAEc.ico
oAko.exe
oIUm.exe
oQkA.exe
oUsm.exe
okIu.exe
okQe.exe
ooom.exe
owEe.exe
qAcU.exe
qAcU.exe
qAwy.exe
qIca.exe
qQUo.exe
qUwy.exe
qYca.exe
qocY.exe
qooC.exe
qwQE.exe
qwsK.exe
sIEI.exe
sIII.exe
skgg.ico
socC.exe
ssYQ.exe
uAEY.exe
uEII.exe
uEUM.exe
uIUa.exe
uQgC.exe
uUIU.ico
uYIE.exe
uwIm.exe
wUUA.exe
wYwc.exe
wcgQ.exe
wkAc.exe
wkQq.exe
woAs.exe
woMA.exe
wwgq.exe
yEMi.exe
yQAA.exe
yUgq.exe
ykYa.exe
ywAK.exe
CloseReset.docx.exe
ReadJoin.bmp.exe
VyYIoYcE.exe
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
VyYIoYcE.inf
memory/372-161-0x0000000000400000-0x0000000000593000-memory.dmp
memory/372-148-0x0000000000400000-0x0000000000593000-memory.dmp
memory/452-35-0x0000000000400000-0x0000000000593000-memory.dmp
memory/452-26-0x0000000000400000-0x0000000000593000-memory.dmp
memory/540-240-0x0000000000400000-0x0000000000593000-memory.dmp
memory/540-229-0x0000000000400000-0x0000000000593000-memory.dmp
memory/880-188-0x0000000000400000-0x0000000000593000-memory.dmp
memory/880-172-0x0000000000400000-0x0000000000593000-memory.dmp
memory/932-249-0x0000000000400000-0x0000000000593000-memory.dmp
memory/932-259-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1000-1761-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1000-1863-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1068-1391-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1068-1451-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1764-49-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1768-447-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1768-509-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2032-129-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2032-147-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2224-132-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2224-118-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2352-252-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2352-237-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2448-1320-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2448-1240-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2488-50-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2488-59-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2496-18-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3000-221-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3000-232-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3240-1906-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3240-1960-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3368-2207-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3368-2134-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3400-1360-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3400-1397-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3428-209-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3428-224-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3508-27-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3508-1-0x00000000008E0000-0x0000000000900000-memory.dmp
memory/3508-28-0x00000000008E0000-0x0000000000900000-memory.dmp
memory/3508-0-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3520-2051-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3520-1986-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3564-312-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3564-305-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3580-1661-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3580-1739-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3612-169-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3612-158-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3772-280-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3772-290-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3832-338-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3832-396-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3884-199-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3884-185-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4068-265-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4068-278-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4072-726-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4072-773-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4120-62-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4120-75-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4168-100-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4168-87-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4220-1859-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4220-1883-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4268-117-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4268-105-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4528-77-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4528-90-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4536-1159-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4536-1224-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4548-541-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4548-600-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4660-203-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4660-215-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4720-10-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4744-1549-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4744-1490-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4776-37-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4804-260-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4804-271-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4824-834-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4824-900-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4860-15-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4864-1009-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4864-942-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4900-1049-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4900-1109-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4940-725-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4940-679-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4956-1604-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4956-1534-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5000-2093-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5000-2164-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5072-2230-0x0000000000400000-0x0000000000593000-memory.dmp