Analysis
- max time kernel
149s - max time network
140s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 17:07
General
- Target 2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe
- Size 1.6MB
- Sample260602-vm9acscv5k
- SHA256 1ba5dec88428be2e096e71f0455500346c0b2ffd9c7d3c4e9c4a1c130bfa0a79
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 20 IoCs
- UAC bypass 3 TTPs 20 IoCs
- Renames multiple (142) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 7 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 60 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 23 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\emQMooEE\pSIgMUcQ.exe"C:\Users\Admin\emQMooEE\pSIgMUcQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\JUMsUIgE\IakYcIgE.exe"C:\ProgramData\JUMsUIgE\IakYcIgE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"14⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"18⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"26⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock27⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"28⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock29⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"30⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock33⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"34⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock37⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"38⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock39⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock"40⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NwowIwoY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""40⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jUwgoEEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""38⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FmwcwMgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rygEUcUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eMAIAcEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""32⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MyswEsUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""30⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qsYUgcoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""28⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xEwkkAUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""26⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lKgMcIQY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""24⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TWsYIUAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jgQowUUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""20⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ocQMcwYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""18⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OgUUIYYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\skIcQUMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PokwYMQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pAAcoUMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dkEoIIEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RSskcwMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XmoYgkwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GWcEIoIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\KWMcskUY\zEUksUEw.exeC:\ProgramData\KWMcskUY\zEUksUEw.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\emQMooEE\pSIgMUcQ.exeC:\Users\Admin\emQMooEE\pSIgMUcQ.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\JUMsUIgE\IakYcIgE.exeC:\ProgramData\JUMsUIgE\IakYcIgE.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
IakYcIgE.exe
IakYcIgE.inf
IakYcIgE.inf
zEUksUEw.exe
overlay.png.exe
vcredist_x64.exe
WuMk.txt
flapper.gif.exe
AutoPlayOptIn.gif.exe
QuotaNearing.png.exe
OneDriveSmallTile.contrast-black_scale-400.png.exe
OneDriveSmallTile.contrast-white_scale-400.png.exe
tinytile.png.exe
2026-06-02_53137bd5de8c86652a1b8c2e3a9ab9d0_elex_virlock
AMQq.exe
AgsY.exe
Aiws.ico
AkwQ.exe
AoQc.exe
AocI.exe
CAYM.exe
CAoE.ico
CMUi.exe
CQQc.exe
CQQk.exe
CUcG.exe
CkkG.exe
EEwW.exe
EYMa.exe
Ekce.exe
EsgU.exe
GIoQ.exe
GQUe.exe
GUos.exe
GWcEIoIk.bat
GcoM.exe
GgoE.exe
GgsG.exe
GwYY.exe
GwYs.exe
ICEo.ico
IEAW.exe
IQwq.exe
Iwoq.exe
KcAO.exe
KcQi.exe
KgAi.exe
Kggo.exe
KkQK.exe
MEIW.exe
MIwg.exe
MkEA.exe
Mkck.exe
MwIw.exe
OIQY.ico
OMsI.exe
OQww.exe
OYES.exe
OcoU.exe
OkUM.exe
QAIg.exe
QMAo.exe
QUgc.exe
QUsy.exe
QYkM.exe
QccI.exe
Qgww.exe
Qmwo.ico
QsAQ.exe
SAQm.exe
SAoG.exe
SEoC.exe
UAca.exe
UAkk.exe
UMsW.exe
UQsW.exe
Ucgq.exe
UkMK.exe
UsIm.exe
UwYQ.exe
WSoI.ico
WWkA.ico
WoMk.ico
WwMK.exe
YIYW.exe
YYEA.exe
Yswi.exe
YwgM.exe
aIwA.exe
aMUW.exe
acsU.exe
ascS.exe
asoG.exe
auMk.ico
awsO.exe
ccIy.exe
ccYA.exe
eEEK.exe
eMEk.exe
ewIu.exe
file.vbs
gMUc.exe
gcME.exe
gkkW.exe
iMwC.exe
iQkY.exe
iQsK.exe
iUUI.ico
iYsC.exe
iocI.exe
kMYc.exe
kYYw.exe
kcYW.exe
kcwQ.exe
kkYi.exe
koUY.exe
mAAC.exe
mEMY.exe
mEkW.exe
mIwe.exe
meAY.ico
mgUK.exe
mgYg.exe
mwIY.exe
oIUc.exe
oMcq.exe
oQMs.exe
oQws.exe
oUck.exe
oYEo.exe
ocAu.exe
ocAw.exe
ocEs.exe
oscs.exe
oska.exe
qIMI.exe
qIkM.exe
qQES.exe
qskG.exe
sEkc.exe
sUEw.exe
sYEu.exe
swcK.exe
swkU.exe
uAIQ.ico
uAgc.exe
uIYM.exe
uQsO.exe
uUAG.exe
uYgU.exe
uYoc.exe
uooY.exe
uowA.exe
usoe.exe
wEQG.exe
wIsm.exe
wYIa.exe
wscA.exe
yQcw.exe
yYws.exe
BlockOptimize.exe
StartDeny.xlsm.exe
WaitAssert.docm.exe
TestUpdate.xls.exe
UnprotectAdd.xlsm.exe
ConfirmStop.xlsx.exe
GrantGet.docx.exe
RegisterUninstall.xls.exe
CheckpointOptimize.docx.exe
CompressGrant.gif.exe
PingEdit.zip.exe
ReceiveUnblock.xls.exe
TraceRedo.bmp.exe
DenySave.wma.exe
FindDismount.jpg.exe
ResetCompare.mp3.exe
MoveDeny.pptm.exe
ResolveUnblock.bmp.exe
DenyUninstall.jpeg.exe
InstallSave.gif.exe
ConvertFromEnable.mp3.exe
NewJoin.bmp.exe
SyncUnregister.docx.exe
ConfirmDebug.docm.exe
RedoCompress.pptm.exe
UnregisterGroup.zip.exe
StepUse.mpg.exe
pSIgMUcQ.exe
pSIgMUcQ.inf
pSIgMUcQ.inf
memory/244-32-0x0000000000400000-0x0000000000593000-memory.dmp
memory/244-49-0x0000000000400000-0x0000000000593000-memory.dmp
memory/332-81-0x0000000000400000-0x0000000000593000-memory.dmp
memory/484-226-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1092-117-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1092-130-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1464-2548-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1464-7-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1476-234-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1496-120-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1732-148-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2092-25-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2092-2563-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2228-109-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2236-171-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2236-162-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2516-1-0x0000000002460000-0x0000000002480000-memory.dmp
memory/2516-0-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2516-31-0x0000000002460000-0x0000000002480000-memory.dmp
memory/2516-30-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3056-201-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3316-71-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3380-208-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3380-198-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3520-217-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3812-44-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3812-61-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4028-142-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4028-159-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4040-27-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4040-2568-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4216-97-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4848-170-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4848-187-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5180-2553-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5180-13-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5776-251-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5776-242-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5840-241-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5840-231-0x0000000000400000-0x0000000000593000-memory.dmp
memory/6100-20-0x0000000000400000-0x0000000000591000-memory.dmp
memory/6100-2558-0x0000000000400000-0x0000000000591000-memory.dmp