Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 16:50
General
- Target 2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe
- Size 1.6MB
- Sample260804-vb7x6adg79
- SHA256 179583a1fd1082e34e3909a1c3b590d3f5cd992735d578194590b1dcaabb7432
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 19 IoCs
- UAC bypass 3 TTPs 19 IoCs
- Renames multiple (111) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 9 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 11 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 19 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 38 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 57 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 21 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\PiQoEwMk\lgMAccwI.exe"C:\Users\Admin\PiQoEwMk\lgMAccwI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\JuwYccAc\eQkcYsks.exe"C:\ProgramData\JuwYccAc\eQkcYsks.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\ProgramData\JuwYccAc\eQkcYsks.exe"C:\ProgramData\JuwYccAc\eQkcYsks.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\PiQoEwMk\lgMAccwI.exe"C:\Users\Admin\PiQoEwMk\lgMAccwI.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock17⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock19⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"20⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock21⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"26⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"28⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"30⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock31⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"34⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"36⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock"38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TCMskwsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""38⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZeggoIYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yEMcoMQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wiwQIYgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""32⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FUkAMkMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dAMEYUsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vuQQYsAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HgUYIQYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YgsAUEkM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CAsQAcoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""20⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MakIIYkM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""18⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV117⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jusswIYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hQIUAMkI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BIkMUQcE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cqcQEgIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AUYIUUEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AQQEYwcs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sUkQYAIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\POkgQMIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock.exe""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\yqQIwUkU\aYAUgAUw.exeC:\ProgramData\yqQIwUkU\aYAUgAUw.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\PiQoEwMk\lgMAccwI.exeC:\Users\Admin\PiQoEwMk\lgMAccwI.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\JuwYccAc\eQkcYsks.exe"C:\ProgramData\JuwYccAc\eQkcYsks.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\JuwYccAc\eQkcYsks.exeC:\ProgramData\JuwYccAc\eQkcYsks.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\PiQoEwMk\lgMAccwI.exe"C:\Users\Admin\PiQoEwMk\lgMAccwI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
eQkcYsks.exe
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
eQkcYsks.inf
qoMY.txt
aYAUgAUw.exe
2026-08-04_04c0096c48e8b79a48c80112a855de90_elex_virlock
AAUo.exe
AIkQ.exe
AIoG.exe
AMIE.ico
AgEA.exe
Aowu.exe
AwgE.ico
CAIK.exe
CIIM.exe
CIce.exe
CMMO.exe
CQMu.exe
CQYK.exe
CQgI.exe
CUUQ.exe
CUsE.exe
CcEu.exe
Ccgs.exe
Cswy.exe
EIYY.exe
EIow.exe
Eswg.exe
GAIE.exe
GEcG.exe
GMEA.exe
GQQA.exe
GUkK.exe
GYAe.exe
GgkY.exe
GwMk.exe
IYwu.exe
IgwO.exe
Ikgq.exe
KCsk.ico
KEMM.exe
KgsY.exe
KoQY.exe
KskM.exe
KwIK.exe
MIQK.exe
MYIW.exe
McUW.exe
MccA.exe
MgYG.exe
MgsK.exe
MkEO.exe
MoYc.exe
OQoo.exe
OgQC.exe
POkgQMIE.bat
QEIy.exe
QIUa.exe
QMAk.exe
Qcwm.exe
QgQK.exe
QgwA.ico
QsYU.ico
SMQC.exe
SYQK.exe
SkkO.exe
SogA.exe
Swcg.exe
UMUg.exe
UYQc.exe
UgYW.exe
UoIi.exe
UwUw.exe
WAAw.exe
WEEc.exe
WEQe.exe
WYMu.exe
WgsA.exe
YAcm.exe
YCcs.ico
YEsM.exe
YUQk.exe
YmgE.ico
YoQQ.exe
YqYg.ico
aAIS.exe
aGcY.ico
acsU.exe
cCgw.ico
cMwM.exe
cYoO.exe
ccgE.exe
eIUm.exe
eQcQ.exe
eQkW.exe
escq.exe
file.vbs
gIIY.exe
gUoK.exe
guIs.ico
iYIU.exe
kEMq.exe
kEUA.ico
kMUq.exe
kUYk.exe
kUsC.exe
kogI.exe
mAEO.exe
mEgU.exe
mYsy.exe
moYS.exe
oEME.exe
oUgK.exe
ooso.exe
oskU.exe
owwq.exe
qAow.exe
qEIY.exe
qEcY.exe
qWUU.ico
qYQK.exe
qoEg.exe
sEEc.exe
sIgY.exe
sccY.exe
skQG.exe
soYM.exe
ssEq.exe
swMO.exe
uEEe.exe
ucgS.exe
uksC.exe
uoEC.exe
uoYk.exe
uosq.exe
uyQU.ico
wEUM.exe
wMww.exe
wUMA.exe
wUMU.exe
wgsa.exe
wgwG.exe
wooO.exe
wwoO.exe
yIQK.exe
yMwE.exe
ygIA.exe
yooS.exe
ywcu.exe
lgMAccwI.exe
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
lgMAccwI.inf
memory/432-151-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1080-2454-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1244-108-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1804-2436-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1928-136-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2164-163-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2716-30-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2716-1-0x0000000002240000-0x0000000002260000-memory.dmp
memory/2716-31-0x0000000002240000-0x0000000002260000-memory.dmp
memory/2716-0-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3128-208-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3432-14-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3432-2195-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3772-221-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3780-2222-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3804-236-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3840-49-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3840-65-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4112-96-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4552-76-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4860-267-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4880-2463-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4916-245-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4920-19-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4920-2204-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4924-53-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5216-2186-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5216-8-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5308-2213-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5392-258-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5468-277-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5520-120-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5544-178-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5800-195-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5972-2445-0x0000000000400000-0x0000000000590000-memory.dmp