Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/09/2026, 12:30
General
- Target 2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe
- Size 1.6MB
- Sample260924-pps39stenb
- SHA256 3678b6a0802cdf577d59d997caf25219a07f4cb4a1a9653bcba84fa776e5e48f
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 54 IoCs
- UAC bypass 3 TTPs 54 IoCs
- Renames multiple (154) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 9 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 11 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 53 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 19 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\DuoQIAws\bqEcoocA.exe"C:\Users\Admin\DuoQIAws\bqEcoocA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\lscccsso\GogoQAsI.exe"C:\ProgramData\lscccsso\GogoQAsI.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\ProgramData\lscccsso\GogoQAsI.exe"C:\ProgramData\lscccsso\GogoQAsI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\DuoQIAws\bqEcoocA.exe"C:\Users\Admin\DuoQIAws\bqEcoocA.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"14⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"16⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"22⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"24⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock27⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"28⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"34⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock35⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"40⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"42⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"44⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"50⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"52⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"54⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"56⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"58⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"60⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"62⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"64⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"66⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"68⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"70⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"72⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"74⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"76⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"82⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock83⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"86⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"88⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"90⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"96⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock99⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"102⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"104⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock"106⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock107⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1108⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2108⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f108⤵
- UAC bypass
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DCUIkscg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""106⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs107⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oeIowcsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""104⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EsQIEYog.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""102⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XOkkQock.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""100⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PucQkUIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""98⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bAswkYQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""96⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dwogcckc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""94⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mKMYggsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""92⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WmAwgUEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""90⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yWIIMock.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GAEwwQcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""86⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TIIgwYQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""84⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\faYIkIck.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""82⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UOoEgYUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""80⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cYgQMkgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""78⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EWMwwowo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""76⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RQsoogMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""74⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fgoksIoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sGIgsMkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sIgkcEgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""68⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\umMgAosQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vKcQYgoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""64⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dSYAkUkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""62⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aYkksEgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""60⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oOoIQQgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""58⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HGMAAcUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dmUoAkEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""54⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cUQYIAkI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""52⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\muocEAUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""50⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VUYIEEIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""48⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pQAIcMgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""46⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lkwwwQQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""44⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zyEIAYoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\seccAUMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""40⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AyMUccYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""38⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmUscMAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""36⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EeEgcAsM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gUgosows.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""32⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nicYcIkE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""30⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zmoIsUsM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""28⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\woEkcUYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tGcoUggo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""24⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XYAkAgIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uWgEIocg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""20⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IUkEEcoQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CeUooEIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FMkowsws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV115⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TGccAIwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MyMYgwME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wSwQswQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FeEIoIwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JIkoMsEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MuwsEIww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock.exe""2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\ProgramData\XMcMgwMc\mUIooQEA.exeC:\ProgramData\XMcMgwMc\mUIooQEA.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\DuoQIAws\bqEcoocA.exeC:\Users\Admin\DuoQIAws\bqEcoocA.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\lscccsso\GogoQAsI.exe"C:\ProgramData\lscccsso\GogoQAsI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\lscccsso\GogoQAsI.exeC:\ProgramData\lscccsso\GogoQAsI.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\DuoQIAws\bqEcoocA.exe"C:\Users\Admin\DuoQIAws\bqEcoocA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
mUIooQEA.exe
GogoQAsI.exe
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
GogoQAsI.inf
zgMs.txt
128.png.exe
2026-09-23_237da7fd4234c990c08549c97bde116e_elex_virlock
AEEa.exe
AEgY.exe
AQcO.exe
AUcm.exe
AkMO.exe
CAgM.exe
CEIm.exe
CIMO.exe
CUAc.exe
Ccow.exe
Cggo.exe
EUIa.exe
EUga.exe
EiEQ.ico
Eogw.exe
EwEA.exe
EwMk.exe
GAQi.exe
GEUA.exe
GMgI.exe
GMkw.exe
GUMk.exe
GUQM.exe
GcoS.exe
GoMU.ico
GwAi.exe
IEgM.exe
IIEa.exe
IIII.exe
IKYI.ico
IQYk.exe
ISgQ.ico
IYMO.exe
Icoi.exe
IoIW.exe
IowA.exe
IsIe.exe
IwUu.exe
KEwI.exe
KIkA.exe
KQsm.exe
Koss.exe
MIww.exe
MUMY.ico
MYUw.exe
MuwsEIww.bat
OAQw.exe
OcMU.exe
OgES.exe
OkQS.exe
QIUG.exe
QIYy.exe
QQEk.exe
QQkY.exe
QYow.exe
QcEg.exe
QcsA.exe
QgYc.exe
Qgwa.exe
SAMO.exe
SEAU.exe
SokU.exe
UAUK.exe
UCcA.ico
UIUw.exe
UIsm.exe
UMMA.exe
UYwG.exe
UgMc.exe
UgYA.exe
WEUw.exe
WIoU.exe
WMAM.exe
WMAM.exe
WMIQ.exe
WQMI.exe
Wgkc.exe
Wgoe.exe
WskQ.exe
YEIa.exe
YMsQ.exe
YQEM.exe
YUoq.exe
YYki.exe
YcAw.exe
YcIU.ico
YcUe.exe
Ygsa.exe
YkYI.exe
YsEU.ico
YsUc.exe
YwIK.exe
aAYI.exe
aIoK.exe
aMEC.exe
aQUW.exe
acgY.exe
ackE.exe
ackw.exe
cUcu.exe
cUoI.exe
ccIY.exe
cgIs.exe
csMI.exe
cwQi.exe
eAMw.exe
eAwy.exe
eEwe.exe
eIwy.exe
egoc.exe
ekEC.exe
file.vbs
gAQW.exe
gEgw.exe
gKck.ico
gMQC.exe
gQUI.exe
gQgk.exe
gQkq.exe
gYEk.ico
gcAQ.exe
gcYm.exe
ggAQ.ico
gkAw.exe
gkQW.exe
gswO.exe
gugk.ico
gwkY.exe
iAUe.exe
iEcs.exe
iUAK.exe
icME.exe
ikYu.exe
ioUq.exe
kEkg.exe
kIwC.exe
kUIM.exe
kkUC.exe
kwom.exe
mEEi.exe
mMAA.exe
mMUQ.exe
mMww.exe
mQkg.exe
mgAY.exe
mgUq.exe
mgYY.ico
msMY.exe
mwYO.exe
oMMY.exe
oQgs.exe
oYYq.exe
oYwo.exe
ocIa.exe
ossG.exe
qAMo.ico
qMkq.exe
qYwQ.exe
qccs.exe
qkMe.exe
sEYw.exe
sMgq.exe
sQIS.exe
scAW.exe
scEm.exe
soUq.exe
ssUG.exe
swsa.exe
uAww.exe
uMoa.exe
uQAK.exe
ucsi.exe
ugEe.exe
ugUE.exe
uoIo.exe
uscW.exe
uwkG.exe
uyAs.ico
wAcW.exe
wEIu.exe
wEkI.exe
wEoc.exe
wMEy.exe
wQcS.exe
wUgW.exe
wYsw.exe
wkIW.exe
wogW.exe
yIcw.exe
yMQo.exe
yOUA.ico
yQIU.exe
yQwS.exe
yUoG.exe
ykIO.exe
yokc.exe
yssg.exe
bqEcoocA.exe
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
bqEcoocA.inf
memory/116-2735-0x0000000000400000-0x0000000000594000-memory.dmp
memory/116-2743-0x0000000000400000-0x0000000000594000-memory.dmp
memory/388-364-0x0000000000400000-0x0000000000594000-memory.dmp
memory/388-330-0x0000000000400000-0x0000000000594000-memory.dmp
memory/628-87-0x0000000000400000-0x0000000000594000-memory.dmp
memory/628-71-0x0000000000400000-0x0000000000594000-memory.dmp
memory/764-40-0x0000000000400000-0x0000000000590000-memory.dmp
memory/784-157-0x0000000000400000-0x0000000000594000-memory.dmp
memory/784-172-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1104-28-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1104-46-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1260-195-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1260-206-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1320-59-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1320-50-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1608-188-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1608-174-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1688-118-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1688-109-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1776-226-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1776-299-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1796-148-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1988-2646-0x0000000000400000-0x0000000000594000-memory.dmp
memory/1988-2654-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2092-64-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2092-74-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2100-230-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2100-220-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2180-25-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2212-810-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2212-868-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2704-2631-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2704-2644-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2744-2620-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2744-2612-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2840-541-0x0000000000400000-0x0000000000594000-memory.dmp
memory/2840-497-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3176-160-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3176-149-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3220-10-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3284-15-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3416-108-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3416-90-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3560-18-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3592-133-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3592-121-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3612-661-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3612-594-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3760-712-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3760-763-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3896-992-0x0000000000400000-0x0000000000594000-memory.dmp
memory/3896-917-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4156-426-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4156-496-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4368-1-0x0000000000740000-0x0000000000760000-memory.dmp
memory/4368-30-0x0000000000740000-0x0000000000760000-memory.dmp
memory/4368-0-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4368-29-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4856-2710-0x0000000000400000-0x0000000000594000-memory.dmp
memory/4856-2702-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5168-2557-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5168-2551-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5180-1089-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5180-2549-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5548-2613-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5548-2599-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5684-2558-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5684-2569-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5876-2669-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5876-2656-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5940-2756-0x0000000000400000-0x0000000000594000-memory.dmp
memory/5940-2740-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6012-2630-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6012-2623-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6140-2733-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6140-2722-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6168-2570-0x0000000000400000-0x0000000000590000-memory.dmp
memory/6240-2572-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6240-2580-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6396-2678-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6396-2666-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6420-2579-0x0000000000400000-0x0000000000590000-memory.dmp
memory/6492-2679-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6492-2693-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6604-2582-0x0000000000400000-0x0000000000590000-memory.dmp
memory/6628-2597-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6628-2583-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6812-2766-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6812-2758-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6908-2780-0x0000000000400000-0x0000000000594000-memory.dmp
memory/6908-2768-0x0000000000400000-0x0000000000594000-memory.dmp
memory/7032-2701-0x0000000000400000-0x0000000000594000-memory.dmp
memory/7032-2684-0x0000000000400000-0x0000000000594000-memory.dmp
memory/7084-2581-0x0000000000400000-0x0000000000590000-memory.dmp
memory/7140-2725-0x0000000000400000-0x0000000000594000-memory.dmp
memory/7140-2711-0x0000000000400000-0x0000000000594000-memory.dmp