Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 14:28
General
- Target 2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe
- Size 1.6MB
- Sample260808-rs7ryadh74
- SHA256 37eed697c3ce32e304d135d85babdfb135cc990a5febbfaec1746a55394af610
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 54 IoCs
- UAC bypass 3 TTPs 54 IoCs
- Renames multiple (143) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 10 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 53 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 19 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\CaYsUowQ\bmkscEYI.exe"C:\Users\Admin\CaYsUowQ\bmkscEYI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\saMEYQgw\EAAsEIQY.exe"C:\ProgramData\saMEYQgw\EAAsEIQY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"20⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"24⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"26⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"32⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"34⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock35⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"40⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"44⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"46⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock47⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"50⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock51⤵
- Adds Run key to start application
-
C:\Users\Admin\oIgEQoog\UeoYAUUQ.exe"C:\Users\Admin\oIgEQoog\UeoYAUUQ.exe"52⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 22453⤵
- Program crash
-
-
-
C:\ProgramData\HWIgYAkg\deocwowI.exe"C:\ProgramData\HWIgYAkg\deocwowI.exe"52⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 22453⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 22453⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 22053⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock53⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"56⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"58⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"60⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"64⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"68⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"70⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"72⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"76⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"78⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock81⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"82⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"84⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"86⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"90⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock101⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"102⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock107⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1108⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2108⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f108⤵
- UAC bypass
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IecMIEoY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""106⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs107⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qMEkIkgU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""104⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WmUYwkgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""102⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lGYokcYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""100⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dCMgQMUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""98⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FskAkwwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""96⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HoYYIMgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""94⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GMUgsQoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""92⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eEMosogk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""90⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IEQwwAUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""88⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\roEEoYwI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""86⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DckgsMUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""84⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zuEocwQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""82⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sGYcgsQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""80⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\saIEUcsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""78⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wkowIMwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HQogAYkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""74⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pacEMkQY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RgYIUIAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qiIQIoEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""68⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cgwscIAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""66⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BaQswMwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DOsEQwUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""62⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iAYQIwoY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""60⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\meUEMIMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""58⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rGAsMAUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uYcUccYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DWcYIgEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""52⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QwkAAYcE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RkEIIosM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""48⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SswooosA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lQsoYQQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hIIYsQYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FSUMIMkI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""40⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dSccsgcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""38⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iisAksIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VEsEUcwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""34⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\noskcoAg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""32⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KWMcQUYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mCEwEgcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""28⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\leAUwgEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DowMIAQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TqgsIwYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mQgsMQsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""20⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mOsUYcEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YsAkckII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zagIEMkk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pGYAockM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UkcYYsQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UIYUYIws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CUocAskM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DMcIAIoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kSccAEow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\ProgramData\ZiUkEYAU\FiEwsEsk.exeC:\ProgramData\ZiUkEYAU\FiEwsEsk.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\CaYsUowQ\bmkscEYI.exeC:\Users\Admin\CaYsUowQ\bmkscEYI.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\saMEYQgw\EAAsEIQY.exe"C:\ProgramData\saMEYQgw\EAAsEIQY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\saMEYQgw\EAAsEIQY.exeC:\ProgramData\saMEYQgw\EAAsEIQY.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
-
C:\ProgramData\AsIkQkkY\OwkIkgQA.exeC:\ProgramData\AsIkQkkY\OwkIkgQA.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 2242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5592 -ip 55921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5524 -ip 55241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5496 -ip 54961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5524 -ip 55241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5524 -ip 55241⤵
-
C:\ProgramData\HWIgYAkg\deocwowI.exeC:\ProgramData\HWIgYAkg\deocwowI.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 2242⤵
- Program crash
-
-
C:\Users\Admin\oIgEQoog\UeoYAUUQ.exeC:\Users\Admin\oIgEQoog\UeoYAUUQ.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 1882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1504 -ip 15041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1372 -ip 13721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1504 -ip 15041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1504 -ip 15041⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
windowsdesktop-runtime-7.0.16-win-x64.exe
TMcc.txt
FiEwsEsk.exe
EAAsEIQY.exe
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
EAAsEIQY.inf
2026-08-08_7ff86a1a6bb1fbd01e8b33afbfe36dc5_elex_virlock
BAQo.exe
BIwk.exe
BMEM.exe
BMEi.exe
BMow.exe
BQYs.exe
BYMS.exe
BYUG.exe
DAIQ.ico
DEEQ.exe
DEMG.exe
DQkm.exe
DUAy.exe
DUMo.exe
DYkY.exe
DgAE.exe
DkUG.exe
DmUg.ico
DsQI.exe
FIwi.exe
FQcA.exe
FcUI.exe
Fgsa.exe
FkUM.exe
FkoW.exe
Fogg.exe
Fwkq.exe
HEUC.exe
HIce.exe
HMwS.exe
HOEg.ico
HUIo.exe
HsAO.exe
JcEI.exe
Jgsk.exe
JkUY.exe
JoIm.exe
JsEq.exe
Jwow.exe
LEEo.exe
LEsk.exe
LUYK.exe
LYAu.exe
LYMi.exe
LasY.ico
Lcga.exe
NAkc.exe
NCkg.ico
NIIS.exe
NQAs.exe
NUIU.exe
NUYG.exe
NoUE.exe
NsAa.exe
PEMq.exe
PEkC.exe
PQYO.exe
PQYu.exe
PkYo.ico
PkoA.exe
PsYE.exe
PwMK.exe
RIES.exe
RQge.exe
RUYa.exe
RcEW.exe
RoUm.exe
Roow.exe
RwkE.exe
TIQa.exe
TMso.exe
TUcq.exe
TcMe.exe
TgAq.exe
Tkwg.exe
TsAQ.exe
TwcM.exe
TwkS.exe
VIAA.exe
VIUa.exe
VcMM.exe
VcgW.exe
VoEu.exe
VsMC.exe
VwYg.exe
XAAe.exe
XAIq.exe
XEQy.exe
XIcO.exe
XQku.exe
XcUC.exe
ZAcC.exe
ZUIQ.exe
ZUQM.exe
ZUsC.exe
ZYEY.exe
ZYkA.exe
ZcgE.exe
ZgQO.exe
bYkk.ico
bgYg.exe
dMkW.exe
dYkA.exe
dowg.exe
fEIA.exe
fEgk.ico
fYcQ.exe
fcky.exe
fgsw.exe
file.vbs
hEkc.exe
hMMi.exe
hQMs.exe
hQoe.exe
hUQg.exe
hYgE.exe
hkcY.exe
hqYo.ico
hsUU.exe
jMUs.exe
jQUY.exe
jQgA.exe
jQok.exe
jUgs.exe
jcMa.exe
jkEa.exe
jkck.exe
joEY.exe
jqMU.ico
jwEE.exe
kSccAEow.bat
lAMM.exe
lAwC.exe
lIMk.ico
lYYm.exe
lcAY.exe
lcUq.exe
lgIE.exe
nMgE.exe
nSwI.ico
nkIO.exe
nwMU.exe
pEkw.exe
pMwe.exe
pQYg.exe
pYAa.exe
pkMC.exe
poQo.exe
psca.exe
rMQS.exe
rQMg.exe
rUQy.exe
rgYS.exe
rgoA.exe
rkMW.exe
rsUo.exe
rwoe.exe
tEMC.exe
tEQS.exe
tEcw.exe
tQYQ.exe
tUIo.exe
tYcG.exe
tgMM.exe
tgcA.exe
tkcq.exe
vMcq.exe
vUME.exe
vcQq.exe
vckW.exe
vgAC.exe
vgsu.exe
vkcI.exe
vsEo.exe
xUcG.exe
xUkg.exe
xsoU.exe
zEES.exe
zMYc.exe
zcEs.exe
zcky.exe
zkQU.exe
bmkscEYI.exe
bmkscEYI.inf
bmkscEYI.inf
bmkscEYI.inf
bmkscEYI.inf
bmkscEYI.inf
bmkscEYI.inf
bmkscEYI.inf
bmkscEYI.inf
bmkscEYI.inf
bmkscEYI.inf
bmkscEYI.inf
bmkscEYI.inf
bmkscEYI.inf
memory/768-106-0x0000000000400000-0x0000000000593000-memory.dmp
memory/876-75-0x0000000000400000-0x0000000000593000-memory.dmp
memory/876-59-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1212-2588-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1236-770-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1236-700-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1304-2522-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1304-2510-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1324-2480-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1324-2493-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1372-2457-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1504-2456-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1504-2481-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1612-699-0x00000000006C0000-0x00000000006E0000-memory.dmp
memory/1612-236-0x00000000006C0000-0x00000000006E0000-memory.dmp
memory/1612-9-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1648-77-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1648-88-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1828-2530-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1828-2523-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2112-247-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2112-256-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2124-18-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2224-2502-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2224-2509-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2304-2479-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2304-2472-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2488-27-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2488-1-0x0000000000600000-0x0000000000620000-memory.dmp
memory/2488-28-0x0000000000600000-0x0000000000620000-memory.dmp
memory/2488-0-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2936-132-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2936-119-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3084-2455-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3084-2442-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3264-2441-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3264-1196-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3268-51-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3444-2579-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3444-2564-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3780-160-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3780-150-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3784-41-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3784-26-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3796-232-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3852-173-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3852-184-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3892-117-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3892-103-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3992-2580-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3992-2587-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4028-145-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4028-128-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4240-202-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4240-187-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4328-974-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4328-2430-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4380-398-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4380-313-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4408-66-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4408-45-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4424-2501-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4424-2494-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4564-2559-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4588-311-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4636-12-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4664-620-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4664-661-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4680-1011-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4680-855-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4692-519-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4692-550-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4792-199-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4792-211-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4796-172-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4796-157-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4832-2443-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4848-35-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4960-436-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4960-496-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4996-222-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4996-214-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5496-2431-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5496-2440-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5524-2460-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5524-2432-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5588-2538-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5588-2531-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5592-2433-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5592-2439-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5604-2471-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5604-2459-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5660-2551-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5660-2545-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5900-2572-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5900-2556-0x0000000000400000-0x0000000000593000-memory.dmp