Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 05:11
General
- Target 2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe
- Size 1.6MB
- Sample261027-ft93xaax21
- SHA256 791b5c55aa7ecaae4f210931d4f2e4cfc97a1472e0b5982e4f247b7f966b7371
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 53 IoCs
- UAC bypass 3 TTPs 53 IoCs
- Renames multiple (131) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 8 IoCs
- Drops file in System32 directory 9 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 52 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 20 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\tQoAgwEI\KAoAAssU.exe"C:\Users\Admin\tQoAgwEI\KAoAAssU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\ProgramData\aqMEUAAQ\nuEcckoM.exe"C:\ProgramData\aqMEUAAQ\nuEcckoM.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\ProgramData\aqMEUAAQ\nuEcckoM.exe"C:\ProgramData\aqMEUAAQ\nuEcckoM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock9⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"18⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"24⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"26⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"30⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"42⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock43⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"46⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"48⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"50⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock51⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"52⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"58⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"62⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"66⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"68⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock69⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"70⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"72⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"74⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"76⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"82⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"88⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock93⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"94⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock95⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"96⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"100⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock101⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock105⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UkIoQQAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""104⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SkAkgEww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""102⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GaEYAYMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ASQwEgUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""98⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fSQMEggA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""96⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\piAkIQUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""94⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fMQgQIYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""92⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eAEUYEUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""90⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AyIQEsQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""88⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eYMkUYoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JcEEoEAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""84⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vUAoEwMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""82⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BwYkAQIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""80⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aAsYkIwY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OmAwUMUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""76⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LysYUMks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zSowIAcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""72⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JIUsAIUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""70⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kiIAQwAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugkAUYcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""66⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XSoYAMwY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JgwoUwAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""62⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RuAgowoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""60⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\quwsYssM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""58⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EEoAwYwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MiUsUoIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""54⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dqkcYAUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""52⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DwgcQAgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""50⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KWAUoAgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uscwssYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\emcUUYII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""44⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ROwEgcUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jUwcUcEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lCYQwUss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""38⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gIswAsgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""36⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RwkgkQAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""34⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XyUYcAAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""32⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cQwkcQQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HcIUwgsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""28⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZqEcQwkw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uCckggQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VcIoUMoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hGwUAkkk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""20⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FMAUkcMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""18⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\euMUoAIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV115⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sUQooYIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XysYMgkQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nWUkUogA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UiEkEAwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\omEQAEcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WAYQEUQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QQgUowko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\zWwIUcAQ\mskkzsEQ.exeC:\ProgramData\zWwIUcAQ\mskkzsEQ.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\ProgramData\aqMEUAAQ\nuEcckoM.exeC:\ProgramData\aqMEUAAQ\nuEcckoM.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\tQoAgwEI\KAoAAssU.exeC:\Users\Admin\tQoAgwEI\KAoAAssU.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
VScU.txt
nuEcckoM.exe
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
nuEcckoM.inf
mskkzsEQ.exe
2026-10-26_db712e9fa38d632b46a741a3485ffab3_elex_virlock
AAkW.exe
AEQC.exe
AMgm.exe
AUwY.exe
AYQI.exe
AYYM.exe
AYYu.exe
AgEU.exe
AkAM.ico
AkIi.exe
AsUE.exe
CAUI.exe
CGcE.ico
CasA.ico
CcQA.ico
EEMg.ico
EIEs.exe
EMQc.exe
EUcA.exe
EYQW.exe
EcUQ.exe
Eksw.exe
Ewki.exe
GAAO.exe
GoIA.exe
IAMO.exe
IYAe.exe
IYMO.exe
IYUQ.exe
IYgi.exe
IccC.exe
IkUM.exe
Ikws.exe
Iwsq.exe
KEse.exe
KUse.exe
KcMs.exe
KkAW.exe
KogG.exe
KwEQ.exe
MAcG.exe
MAcQ.exe
MMUi.exe
MUce.exe
OAwC.exe
OEYS.exe
OcIg.exe
Okgy.exe
OwkI.exe
QAcO.exe
QEkE.exe
QMIc.exe
QMYY.exe
QMYc.exe
QQgUowko.bat
QQok.exe
QUEI.exe
QcwY.exe
SMQy.exe
SMgk.exe
SUUo.exe
SoUM.exe
UAQu.exe
UMwi.exe
UQwA.ico
UYQo.exe
UcIa.exe
Uccg.exe
UgUK.exe
Ukse.exe
WQYi.exe
WUQU.exe
WYYI.exe
WgYc.exe
WkoC.exe
YIYo.exe
YQII.ico
YYIu.exe
YcAw.ico
YwgK.exe
aMkk.exe
aQce.exe
aUEi.exe
aUQw.exe
acEk.exe
akcc.exe
akwU.exe
aoIS.exe
asAW.exe
awsy.exe
cAgy.exe
cIgU.ico
cIow.exe
cYwm.exe
ccUC.exe
cgMm.exe
ckoU.exe
eAMe.exe
eEsQ.exe
eMYO.exe
ecYC.exe
ecoa.exe
egUc.exe
ekEO.exe
ekMu.exe
esQq.exe
file.vbs
gEUW.exe
gQkO.exe
gUUq.exe
gUce.exe
gosS.exe
isQC.exe
kAME.exe
kEws.exe
kcIQ.exe
kcss.exe
kkIw.exe
kqQw.ico
ksky.exe
mMEE.exe
mMss.exe
mkoa.exe
moIe.exe
mosc.exe
muMY.ico
oCwI.ico
oIsk.exe
oKIs.ico
oYYa.exe
ooYq.exe
osIE.exe
osMg.exe
qIME.exe
qMok.exe
qckC.exe
qoMm.exe
sIIM.exe
sIog.exe
sMYS.exe
sMYu.exe
scQM.exe
skcq.exe
soAu.exe
ssEe.exe
sswy.exe
swIE.exe
uEMe.exe
uMco.exe
uMwE.exe
uQsM.exe
uUgU.exe
uUoO.exe
usEQ.exe
usEU.exe
usIK.exe
uwQA.exe
wIMg.exe
wOAI.ico
wQYy.exe
wQgG.exe
wgAG.exe
yEwU.exe
yUga.exe
yUkc.exe
yoks.exe
KAoAAssU.exe
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
KAoAAssU.inf
memory/756-89-0x0000000000400000-0x000000000059B000-memory.dmp
memory/756-77-0x0000000000400000-0x000000000059B000-memory.dmp
memory/1360-49-0x0000000000400000-0x000000000059B000-memory.dmp
memory/1360-32-0x0000000000400000-0x000000000059B000-memory.dmp
memory/1744-26-0x0000000000400000-0x000000000059B000-memory.dmp
memory/1744-27-0x00000000006D0000-0x00000000006F0000-memory.dmp
memory/1744-1-0x00000000006D0000-0x00000000006F0000-memory.dmp
memory/1744-0-0x0000000000400000-0x000000000059B000-memory.dmp
memory/1812-472-0x0000000000400000-0x000000000059B000-memory.dmp
memory/1812-516-0x0000000000400000-0x000000000059B000-memory.dmp
memory/1824-15-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1852-2194-0x0000000000400000-0x000000000059B000-memory.dmp
memory/1852-2186-0x0000000000400000-0x000000000059B000-memory.dmp
memory/1932-2085-0x0000000000400000-0x000000000059B000-memory.dmp
memory/1932-920-0x0000000000400000-0x000000000059B000-memory.dmp
memory/2104-31-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2112-2114-0x0000000000400000-0x000000000059B000-memory.dmp
memory/2112-2104-0x0000000000400000-0x000000000059B000-memory.dmp
memory/2124-150-0x0000000000400000-0x000000000059B000-memory.dmp
memory/2124-161-0x0000000000400000-0x000000000059B000-memory.dmp
memory/2196-99-0x0000000000400000-0x000000000059B000-memory.dmp
memory/2196-115-0x0000000000400000-0x000000000059B000-memory.dmp
memory/2688-44-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3120-2221-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3120-2235-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3320-2131-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3372-18-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3384-2115-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3384-2123-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3464-189-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3464-177-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3536-433-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3536-377-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3632-61-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3632-50-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3804-119-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3804-132-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3884-2095-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3884-2088-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3892-2163-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3892-2173-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3960-601-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3960-530-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3980-198-0x0000000000400000-0x000000000059B000-memory.dmp
memory/3980-219-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4036-2245-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4036-2236-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4064-2135-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4064-2120-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4140-78-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4140-59-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4196-176-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4196-162-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4256-206-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4256-234-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4576-2084-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4576-638-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4732-2286-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4732-2271-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4772-102-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4772-92-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4792-2138-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4792-2145-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4816-12-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4884-280-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4884-336-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4904-129-0x0000000000400000-0x000000000059B000-memory.dmp
memory/4904-146-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5052-2308-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5132-2107-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5132-2092-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5136-2157-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5136-2166-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5208-2216-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5208-2224-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5220-2250-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5220-2264-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5248-2279-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5248-2295-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5380-2142-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5380-2156-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5436-2266-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5436-2274-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5668-2174-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5668-2185-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5688-2315-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5688-2303-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5716-2253-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5716-2242-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5732-2195-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5732-2202-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5772-2323-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5976-2292-0x0000000000400000-0x000000000059B000-memory.dmp
memory/5976-2302-0x0000000000400000-0x000000000059B000-memory.dmp
memory/6092-2207-0x0000000000400000-0x000000000059B000-memory.dmp
memory/6092-2215-0x0000000000400000-0x000000000059B000-memory.dmp