Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/08/2026, 11:09
General
- Target 2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe
- Size 1.6MB
- Sample260820-m871esar4w
- SHA256 bb2631a45dcbebb6e54b343d00b057143e16517e3f8c321c12374b62fbd10567
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 56 IoCs
- UAC bypass 3 TTPs 56 IoCs
- Renames multiple (131) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 8 IoCs
- Drops file in System32 directory 12 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 55 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 19 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\aKYcoYoc\nEMoMMUo.exe"C:\Users\Admin\aKYcoYoc\nEMoMMUo.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\BEYkAcIs\AWwEscoA.exe"C:\ProgramData\BEYkAcIs\AWwEscoA.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\ProgramData\BEYkAcIs\AWwEscoA.exe"C:\ProgramData\BEYkAcIs\AWwEscoA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"16⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock19⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"20⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"26⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"28⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"30⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"32⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"34⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"42⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"44⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"46⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"54⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"58⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock59⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"60⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock65⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock67⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"68⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock73⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"76⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock77⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"78⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"80⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"82⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"84⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock87⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"88⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"92⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"94⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock97⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"98⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"100⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"102⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock103⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"104⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"108⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock"110⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock111⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1112⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2112⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f112⤵
- UAC bypass
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2110⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f110⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\soIcgwQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""110⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs111⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1108⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2108⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f108⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YigIYEww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs109⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PAkQQkgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""106⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs107⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NWcwggkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""104⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HqEQUcwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""102⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wcAcYooY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""100⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cScgskAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""98⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ikgYwEoQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""96⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lwosEgUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""94⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LcIosUUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""92⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DgMMMAUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YmskQgQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""88⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wqsAskEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JiYEoAoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""84⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FugkswcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""82⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DQEUksoM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""80⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Qqcckssk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""78⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SqogIsAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""76⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BIwsQAgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""74⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LiwUMUAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""72⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nOIsogAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MwcwgkMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IcosIYUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""66⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LQogckYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""64⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tKUEkcco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""62⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oMYYIEkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MCEcssAI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""58⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yIsUoYAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LmEkogQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hicYYIAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""52⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eCYcIQAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""50⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MQgYcAwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eyQwIogA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LywgMYss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NoMEMoAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ywwokAEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OiAYUsEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FmEwEMwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TqMMQAAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JoggIQcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dOsQcgoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eEosgcIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RAIsQEYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zoMQksww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cKYoQsUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\quAUowsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""20⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iyUgYUsk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vwUQsggw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HSYQIIMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OqkMAUYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CAcsMckU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YUkQEkoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FsEUgUAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RMokQswE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EOQMIcgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock.exe""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\ProgramData\TkUYswIw\BwUcIQkg.exeC:\ProgramData\TkUYswIw\BwUcIQkg.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\aKYcoYoc\nEMoMMUo.exeC:\Users\Admin\aKYcoYoc\nEMoMMUo.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\BEYkAcIs\AWwEscoA.exeC:\ProgramData\BEYkAcIs\AWwEscoA.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 75ff4ab7121794b2eb2a0acb15d73ed6 Vpvk/wXnu0K/RkPq1i/chg.0.1.0.0.01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
AWwEscoA.exe
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
AWwEscoA.inf
overlay.png.exe
PaYA.txt
BwUcIQkg.exe
128.png.exe
2026-08-20_ec545d3d471d7f4170180b3017e1fa96_elex_virlock
AEIo.exe
AIgu.exe
AkUW.exe
AkYW.exe
AssU.exe
CAwK.exe
CMMm.exe
CYEe.exe
CYwC.exe
CgIi.exe
EIgQ.exe
EOQMIcgo.bat
EyEk.ico
GQEY.exe
GUUA.exe
GUgi.exe
Gwkm.exe
IAYo.exe
IEEG.exe
IkEs.exe
KCEo.ico
KMwU.exe
KYQQ.exe
KYoU.exe
KkYW.exe
KoUi.exe
KwEa.exe
MIEQ.exe
MMsE.exe
McAq.exe
MgQQ.exe
Mgws.exe
MoMC.exe
MsQc.exe
OIQa.exe
OMMQ.exe
OOoA.ico
OQMq.exe
OYoS.exe
OcQM.exe
OgEY.exe
OgYM.exe
OkEo.exe
OoEO.exe
OsMC.exe
QIoI.exe
QQQE.exe
QgUe.exe
Qswy.exe
QwIi.exe
SIEg.exe
SOwA.ico
SgYc.exe
Sgkq.exe
SkUc.exe
SksU.exe
SsUw.exe
UsAm.exe
WAQu.exe
WAYi.exe
WEkK.exe
WUIy.exe
WYcq.exe
WccG.exe
WccI.exe
WwMI.exe
YEAm.exe
YMMA.exe
YMoY.exe
YQgq.exe
YUYY.exe
YUkM.exe
YYsg.exe
Ycws.exe
YgYu.exe
YkIY.exe
Yscg.exe
aEwe.exe
aIgo.ico
aUgw.exe
aUoM.exe
agUA.exe
aogK.exe
asMi.exe
auYk.ico
cEoe.exe
cIco.exe
cIwG.exe
cMAw.exe
ckAw.exe
cowE.exe
cwoy.exe
eEYs.ico
eEwy.exe
eMUu.exe
eMsg.exe
eYoU.exe
ecMs.exe
egUo.exe
file.vbs
gEEU.exe
gMIS.exe
gYYc.exe
gcMm.exe
ggYI.exe
ggwK.exe
goYI.exe
gokY.exe
gqco.ico
gwAO.exe
iAwQ.ico
iYQk.exe
iokw.exe
ioos.exe
kIsi.exe
kMAk.exe
kQQY.exe
kgAy.exe
koQY.exe
kwMO.exe
mAwE.exe
mcUa.exe
mkoU.exe
mosa.exe
mwIK.exe
mwgM.ico
oAAi.exe
oMso.exe
oUgw.exe
ogcu.exe
osMu.exe
osoQ.exe
owIA.exe
qEsM.exe
qOQU.ico
qsMk.exe
qwwQ.exe
sEUo.exe
sEwA.exe
sIgW.exe
sIks.exe
scUa.exe
scsw.ico
skUM.exe
uEIQ.exe
uMcq.exe
uMsG.exe
uQsg.exe
wAwU.exe
wEsc.exe
wgMk.exe
wgQs.exe
wgcy.exe
wkAW.exe
wwAc.exe
yEge.exe
yYAS.exe
yYUS.exe
yYcs.exe
yccs.exe
ykwa.exe
yogI.exe
ywkM.exe
nEMoMMUo.exe
nEMoMMUo.inf
nEMoMMUo.inf
nEMoMMUo.inf
nEMoMMUo.inf
nEMoMMUo.inf
nEMoMMUo.inf
nEMoMMUo.inf
nEMoMMUo.inf
nEMoMMUo.inf
nEMoMMUo.inf
nEMoMMUo.inf
memory/388-87-0x0000000000400000-0x0000000000598000-memory.dmp
memory/436-88-0x0000000000400000-0x0000000000598000-memory.dmp
memory/436-97-0x0000000000400000-0x0000000000598000-memory.dmp
memory/444-2305-0x0000000000400000-0x0000000000598000-memory.dmp
memory/444-2294-0x0000000000400000-0x0000000000598000-memory.dmp
memory/472-353-0x0000000000400000-0x0000000000598000-memory.dmp
memory/472-478-0x0000000000400000-0x0000000000598000-memory.dmp
memory/696-133-0x0000000000400000-0x0000000000598000-memory.dmp
memory/696-146-0x0000000000400000-0x0000000000598000-memory.dmp
memory/924-2252-0x0000000000400000-0x0000000000598000-memory.dmp
memory/924-2245-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1132-2188-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1132-2196-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1216-2137-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1216-2145-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1228-2272-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1472-174-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1472-161-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1568-42-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1592-2265-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1592-2257-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1656-1-0x0000000000820000-0x0000000000840000-memory.dmp
memory/1656-0-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1656-26-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1656-27-0x0000000000820000-0x0000000000840000-memory.dmp
memory/1732-201-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1732-190-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1984-13-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2132-57-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2196-215-0x00000000007D0000-0x00000000007F0000-memory.dmp
memory/2196-7-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2196-2014-0x00000000007D0000-0x00000000007F0000-memory.dmp
memory/2240-2306-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2240-2315-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2316-240-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2316-316-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2324-2355-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2324-2345-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2376-75-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2376-63-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2900-34-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2912-2322-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2912-2312-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2968-2203-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2968-2193-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2980-46-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2980-28-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3100-2113-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3308-2124-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3308-2105-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3428-116-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3428-128-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3716-20-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3884-252-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3884-228-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4092-219-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4092-205-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4184-429-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4184-513-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4244-2216-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4244-2208-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4300-2284-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4300-2274-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4540-2285-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4540-2293-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4636-2217-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4636-2224-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4676-2175-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4676-2167-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4836-171-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4836-188-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4940-103-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4940-115-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5032-145-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5032-157-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5076-1994-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5076-655-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5100-540-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5100-609-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5444-2125-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5444-2136-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5636-2146-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5636-2154-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5740-2015-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5740-2063-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5860-2165-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5860-2153-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5864-2333-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5864-2343-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5920-2244-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5964-2336-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5964-2327-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5980-2186-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5980-2172-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5996-2236-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5996-2225-0x0000000000400000-0x0000000000598000-memory.dmp