Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 02:02
General
- Target 2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe
- Size 1.6MB
- Sample260706-cghlcag19x
- SHA256 6b7b9ab820642d0e091e656e5d8eb7b127e824b5d325b89112424e5598bb85f8
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 22 IoCs
- UAC bypass 3 TTPs 22 IoCs
- Renames multiple (127) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 7 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 8 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 20 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\esYgMYAk\PWMQgwow.exe"C:\Users\Admin\esYgMYAk\PWMQgwow.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\SwIUYcAg\JycgEoUs.exe"C:\ProgramData\SwIUYcAg\JycgEoUs.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\SwIUYcAg\JycgEoUs.exe"C:\ProgramData\SwIUYcAg\JycgEoUs.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock15⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"18⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock19⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"20⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock21⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"22⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock27⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"28⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock29⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"30⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock35⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock37⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"38⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock39⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"40⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock43⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock"44⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gKokcoAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HUUMEEko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RUgkYsgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HYUUMAwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RgsswwwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""36⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OgQAoIIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kWoYgQYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pyskwscA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FSIUkgYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""28⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YAsoggII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iEMwYMYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xWIEUQIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""22⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HgwQYgMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\skkAkYwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vmMYkkss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jukwQQwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZeccsEkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mAUAUYkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KwgUsQAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qgIUgQIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tcMkskQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HKIQYsgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock.exe""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\ProgramData\qiwUwoMw\qeYEUIks.exeC:\ProgramData\qiwUwoMw\qeYEUIks.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\esYgMYAk\PWMQgwow.exeC:\Users\Admin\esYgMYAk\PWMQgwow.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\SwIUYcAg\JycgEoUs.exe"C:\ProgramData\SwIUYcAg\JycgEoUs.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5124 -s 2323⤵
- Program crash
-
-
-
C:\ProgramData\SwIUYcAg\JycgEoUs.exeC:\ProgramData\SwIUYcAg\JycgEoUs.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5124 -ip 51241⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
JycgEoUs.exe
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
JycgEoUs.inf
qeYEUIks.exe
xAkY.txt
2026-07-06_770380c1f1d40bde7064e7803f5b2678_elex_virlock
AIIW.exe
AIcY.exe
AMsQ.exe
AwEY.exe
AwQe.exe
BIws.exe
BYYm.exe
BsII.exe
CMsu.exe
CQIG.exe
CsES.exe
CsQg.exe
CwIA.exe
DUYU.exe
DcwK.exe
DeUc.ico
DkYk.exe
EEcE.exe
EMQs.exe
EYMg.exe
EsAs.exe
FMEq.exe
FYQC.exe
FwkE.exe
GEoS.exe
GQUw.exe
GcMO.exe
GowS.exe
Gwwg.exe
HQok.exe
HUIY.ico
IEcC.exe
IIQE.exe
IMsG.exe
IYci.exe
IkEE.exe
IsQE.exe
KQYI.exe
KcMS.exe
KgIY.exe
KwMC.exe
LMwU.exe
LMww.exe
LsQS.exe
MAcm.exe
McEM.exe
NAUs.exe
NQwa.exe
Ncsc.exe
NsUW.exe
NwUY.exe
OYww.exe
PEME.exe
PUEq.exe
PkYy.exe
QQMM.exe
QUAW.exe
Qswm.exe
RMYs.exe
RYAm.exe
RmgY.ico
TQoW.exe
TUIe.exe
TkcE.exe
UEgm.exe
UMkK.exe
UQkW.exe
UkQy.exe
UksK.exe
VAUm.exe
VMwA.exe
VYUC.exe
WEAS.exe
WMIW.exe
XAkg.exe
XMog.ico
XMsq.exe
XUAK.exe
Xwwy.exe
YEsY.exe
YYAA.exe
Yswu.exe
ZIkO.exe
ZYIM.exe
ZocY.exe
ZwoE.exe
aQEA.exe
aYcw.exe
asww.ico
bMkU.exe
bOgo.ico
bQkQ.exe
cAQM.exe
cEMm.exe
cIsa.exe
coII.exe
coce.exe
dQkm.exe
dakw.ico
dcUi.exe
dgYs.exe
dwMs.exe
eIEk.exe
eYos.exe
fUsQ.exe
file.vbs
fwMY.exe
gEwK.exe
gOEA.ico
gQUM.exe
gcoy.exe
gwAW.exe
hMkA.exe
hUIs.ico
hooc.exe
hwkG.exe
iMUw.exe
icAW.exe
iwsy.exe
jUcE.ico
jUsM.exe
jkcG.exe
jowM.exe
jsIm.exe
jsUg.exe
kMEi.exe
kQco.exe
kcYG.exe
lYYy.exe
mEQY.exe
mSUA.ico
mwww.exe
nIIK.exe
nwAG.exe
oEYi.exe
oYoM.exe
osgI.exe
owsI.exe
pMEE.exe
qIsE.exe
qMMq.exe
qUIm.exe
qUUY.exe
qYMQ.exe
qYMi.exe
rEok.exe
rUgW.exe
rYUM.exe
rooO.exe
rwEM.exe
skcw.exe
soAA.exe
tGEM.ico
tcMkskQk.bat
tsEu.exe
uIIA.ico
uYIE.exe
uksE.exe
uwcs.exe
vsAG.exe
vsUQ.exe
xIMk.exe
xYIQ.exe
xuYM.ico
yGYE.ico
yQgI.exe
ygcY.exe
zAUq.exe
zEco.exe
zMsI.exe
zoIk.ico
zosw.exe
PWMQgwow.exe
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
PWMQgwow.inf
memory/2020-276-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2020-292-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2092-94-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2460-39-0x0000000000B90000-0x0000000000BB0000-memory.dmp
memory/2460-38-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2460-1-0x0000000000B90000-0x0000000000BB0000-memory.dmp
memory/2460-0-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2592-2337-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2668-2353-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2712-299-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2712-312-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2732-2484-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2740-303-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2796-2325-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2796-16-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2984-138-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3144-2331-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3144-19-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3392-267-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3412-107-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3956-197-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4004-235-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4160-181-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4196-246-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4764-46-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4824-169-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5124-2075-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5124-2077-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5156-152-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5204-2319-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5204-7-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5300-225-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5312-211-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5460-257-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5492-121-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5688-82-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5924-56-0x0000000000400000-0x0000000000593000-memory.dmp
memory/6080-280-0x0000000000400000-0x0000000000593000-memory.dmp