Analysis
- max time kernel
150s - max time network
114s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 18:36
General
- Target 2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe
- Size 2.1MB
- Sample260602-w8yanacy2v
- SHA256 2023f512806e38733d48f203f796fd3ca6fdad1c6a2078929ece3e404fb2ec36
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 34 IoCs
- UAC bypass 3 TTPs 34 IoCs
- Renames multiple (157) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 7 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 21 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SQIIMkUw\JIEEgcEM.exe"C:\Users\Admin\SQIIMkUw\JIEEgcEM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\hkAQwAUA\UIgkIUAo.exe"C:\ProgramData\hkAQwAUA\UIgkIUAo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock13⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"16⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock17⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"18⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"20⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock21⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock27⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"30⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"32⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"44⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock51⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"52⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"54⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock55⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock57⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"58⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"60⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock"68⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TqIkwoMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TwQsAgQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JMUYYQAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WuwMYkIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""62⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eiMEEoAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LYMwUwUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MGcEksUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aGkkoAIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""54⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV155⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgsggcso.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GUkEMEYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CmEAAcAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rqUAowYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rEQYAcgg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WGEUAgwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aKMAgoUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iAUsYcgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wcgggAwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""36⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ryMYUAUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PcskkIAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dQIIkQgs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KiEEgAQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IgwEgwUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aeUQQEYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""24⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sCEcAUwg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hQgoYkIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TGoQAkoo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fWMQMAIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UmsIUEgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msEYEEws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uMIgEIsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RCsccUEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ViUoEcIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zOwkIwgw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SakUMUwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\ProgramData\xyMMAAwk\FGUkQcYk.exeC:\ProgramData\xyMMAAwk\FGUkQcYk.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\SQIIMkUw\JIEEgcEM.exeC:\Users\Admin\SQIIMkUw\JIEEgcEM.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\hkAQwAUA\UIgkIUAo.exeC:\ProgramData\hkAQwAUA\UIgkIUAo.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
background.png.exe
watermark.png.exe
UIgkIUAo.exe
wcEY.txt
FGUkQcYk.exe
48.png.exe
AppErrorBlue.png.exe
2026-06-02_5de74b1bd254888123a1510ef7eb4416_elex_virlock
AAQo.exe
AAkq.exe
AEAI.exe
AEMS.exe
AIgE.exe
AMkQ.exe
AUYw.exe
AcUs.exe
Acga.exe
AkoK.exe
AoAy.exe
AooC.exe
Awcy.exe
Cksk.exe
CsQs.exe
EIki.exe
EMsc.exe
EUwM.exe
EwIs.exe
GAgK.exe
GIkO.exe
GUES.exe
GcQq.exe
GsUu.exe
IAEa.exe
IEsk.exe
IMQU.exe
IQAO.exe
IUkY.exe
IUks.exe
Icce.exe
IkIs.ico
IogE.exe
KAIS.exe
KEAu.exe
KEEM.exe
KEUi.exe
KMss.exe
KYMU.exe
Kcsw.exe
KgMI.exe
KkoQ.ico
Kmsg.ico
KwIa.exe
MEwE.exe
MGoM.ico
MYMi.exe
McMO.exe
McQE.exe
Mkgo.exe
MwMu.exe
OEcA.exe
OIkc.exe
OYIk.exe
OYgI.exe
OgQO.exe
OkEE.exe
OwAw.exe
QAUo.exe
QEIy.exe
QQMs.exe
QQYg.exe
QQwO.exe
SAgM.exe
SakUMUwU.bat
Scwu.exe
Sgsq.exe
Soga.exe
SsQg.exe
Sska.exe
SsoU.exe
UQUM.exe
UQgu.exe
UUIE.exe
UocG.exe
UsUc.exe
WMAm.exe
WMIY.exe
WMQe.exe
WQMo.exe
WQgE.exe
WQki.exe
WQoC.exe
WUwk.exe
Wacc.ico
WckQ.ico
WoEk.exe
YAcO.exe
YEIq.exe
YIEM.exe
YIYI.exe
YIkk.exe
YIse.exe
YMkO.exe
YYEi.exe
YYsk.exe
YgUU.exe
Yosq.exe
aAgI.exe
aAgQ.exe
aEUG.exe
aMEC.exe
aMcq.exe
aMkk.exe
aYgE.exe
asgY.exe
awIO.exe
cIUe.exe
cQYI.ico
cQsE.exe
cUAe.exe
cUYM.exe
ccwc.exe
cgAg.exe
cgUC.exe
cswC.exe
cwAi.exe
cwku.exe
eUYg.exe
ekYi.exe
esky.exe
file.vbs
gAUG.exe
gKwI.ico
gQYK.exe
gcUA.exe
gsUC.exe
gwYK.exe
iAQo.ico
iQYu.exe
igMQ.exe
ioMo.exe
iogi.exe
kgMQ.exe
kwYu.exe
mAMW.exe
mIAS.exe
mMwW.exe
mQcG.exe
mUMc.exe
mkEC.exe
moEe.exe
mwUs.exe
oEQK.exe
oIgk.exe
oYAq.exe
ocwE.exe
ogcg.exe
qEEC.exe
qIUc.exe
qUIa.exe
qcIE.exe
qcMa.exe
qoQy.exe
sAYU.exe
soYQ.ico
uAci.exe
uEEs.exe
uIMO.exe
uQsO.exe
uYYS.exe
ugUQ.exe
wAIW.exe
wUQw.exe
wcEu.exe
wkQY.exe
woUc.exe
woUg.exe
wsgw.exe
yEcm.exe
yIMU.ico
yUIy.exe
ygIc.exe
ygMw.exe
ygsc.exe
ykEs.exe
ykoU.exe
yowW.exe
ysMC.exe
yscU.exe
SwitchUse.pptx.exe
UninstallWait.gif.exe
WritePublish.mp3.exe
SetLimit.jpeg.exe
ImportClear.pdf.exe
ConvertAssert.xls.exe
MeasureShow.xlsx.exe
ApproveSync.jpeg.exe
UndoRestart.rar.exe
MountUninstall.jpeg.exe
SendMeasure.jpeg.exe
JIEEgcEM.exe
JIEEgcEM.inf
JIEEgcEM.inf
JIEEgcEM.inf
JIEEgcEM.inf
memory/240-943-0x0000000000400000-0x0000000000624000-memory.dmp
memory/240-991-0x0000000000400000-0x0000000000624000-memory.dmp
memory/788-230-0x0000000000400000-0x0000000000624000-memory.dmp
memory/788-241-0x0000000000400000-0x0000000000624000-memory.dmp
memory/848-418-0x0000000000400000-0x0000000000624000-memory.dmp
memory/848-314-0x0000000000400000-0x0000000000624000-memory.dmp
memory/924-1-0x0000000000A80000-0x0000000000AA0000-memory.dmp
memory/924-0-0x0000000000400000-0x0000000000624000-memory.dmp
memory/924-27-0x0000000000A80000-0x0000000000AA0000-memory.dmp
memory/924-26-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1068-257-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1068-268-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1508-205-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1508-190-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1580-875-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1580-946-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1740-562-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1740-608-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1772-70-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1772-57-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1800-639-0x0000000000400000-0x0000000000624000-memory.dmp
memory/1800-711-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2056-214-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2056-202-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2240-290-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2240-323-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2316-975-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2316-1096-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2320-29-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2320-2825-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2368-122-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2368-108-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2512-80-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2696-97-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2696-111-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2720-815-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2720-890-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2744-2810-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2744-10-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2916-18-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2916-2820-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2952-174-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2952-193-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2964-152-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2964-138-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2976-60-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2976-41-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2992-100-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2992-81-0x0000000000400000-0x0000000000624000-memory.dmp
memory/3648-274-0x0000000000400000-0x0000000000624000-memory.dmp
memory/3648-286-0x0000000000400000-0x0000000000624000-memory.dmp
memory/3824-211-0x0000000000400000-0x0000000000624000-memory.dmp
memory/3824-224-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4032-162-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4032-149-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4048-163-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4048-177-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4188-233-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4500-2815-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4500-15-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4508-31-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4508-2835-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4540-476-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4540-403-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4596-119-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4596-139-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4628-277-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4628-265-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4732-829-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4732-763-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4776-251-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4776-238-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4784-44-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4796-580-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4796-654-0x0000000000400000-0x0000000000624000-memory.dmp
memory/5068-260-0x0000000000400000-0x0000000000624000-memory.dmp