Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
04/10/2026, 15:58
General
- Target 2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe
- Size 2.1MB
- Sample261004-tejjasws5p
- SHA256 9f81377964fe8424e0ea880ca51d05e93585a095d81ce9e4cfb94b81afc0c033
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 16 IoCs
- UAC bypass 3 TTPs 16 IoCs
- Renames multiple (124) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 8 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 10 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 16 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 32 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 48 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 21 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\XeQEYUIY\lisooYoQ.exe"C:\Users\Admin\XeQEYUIY\lisooYoQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\aGAAYMgk\ncYwwAkU.exe"C:\ProgramData\aGAAYMgk\ncYwwAkU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\XeQEYUIY\lisooYoQ.exe"C:\Users\Admin\XeQEYUIY\lisooYoQ.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock9⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock21⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"24⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock27⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock29⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"30⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock"32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uCQAcUcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BsIYMMEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""30⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fAAQwYkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""28⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tossYgkM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DEcgokoo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""24⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QuQEMwgU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UcgIsIYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BsoAkcws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV117⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dwAYoUMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BGUsgswA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WyEAsYME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ockEsEIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aeoMIoQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BmwMkUsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zSYgcYUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KiYkokAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock.exe""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\ProgramData\qMkssYgs\rIYYMoQg.exeC:\ProgramData\qMkssYgs\rIYYMoQg.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\ProgramData\aGAAYMgk\ncYwwAkU.exeC:\ProgramData\aGAAYMgk\ncYwwAkU.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\XeQEYUIY\lisooYoQ.exe"C:\Users\Admin\XeQEYUIY\lisooYoQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\XeQEYUIY\lisooYoQ.exeC:\Users\Admin\XeQEYUIY\lisooYoQ.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
C:\ProgramData\aGAAYMgk\ncYwwAkU.exe"C:\ProgramData\aGAAYMgk\ncYwwAkU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
ncYwwAkU.exe
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
ncYwwAkU.inf
cEQM.txt
rIYYMoQg.exe
2026-10-03_2a08a0f40095463c4a4e50c040740682_elex_virlock
AAsC.exe
AEci.exe
AQgo.ico
AScQ.ico
AWgE.ico
AusU.ico
AwEw.exe
CAUQ.exe
CAYG.exe
CAgM.exe
CMAO.exe
CMoM.exe
CQMe.exe
CQQo.exe
CUYW.exe
CUcQ.exe
Cgwk.exe
CwEu.exe
EEYe.exe
EMgK.exe
EYIc.exe
EcIw.exe
GEQA.exe
GIse.exe
GUky.exe
GiAE.ico
GoQy.exe
GuYU.ico
IAwS.exe
IIoE.ico
IMcm.exe
IgEm.exe
IssQ.exe
IwEE.exe
KAkE.exe
KQkI.exe
KiYkokAc.bat
KoAe.exe
KwAu.exe
KyMU.ico
MMQC.exe
MMgk.exe
MUki.exe
MYUo.exe
MekU.ico
MwIU.exe
OAMK.exe
Occm.exe
OwkS.exe
QAkI.exe
QEQu.exe
QQII.exe
QQYg.exe
QQky.exe
QcUk.ico
Qkcy.exe
QogM.exe
QsMU.exe
SAUI.exe
SIIq.exe
SkIC.exe
SoUc.exe
SwIg.exe
Swoo.exe
UAMo.exe
UQQG.exe
UQwc.exe
UYoc.exe
UwAE.exe
WMYQ.exe
WMsK.exe
WcUm.exe
YIUK.exe
YIoI.exe
YMEc.exe
YMYY.exe
YUoy.exe
YYAI.exe
YcME.exe
YcwM.ico
YoIg.exe
YsQW.exe
aAUS.exe
aEcc.exe
aYYU.exe
awsS.exe
cEsk.exe
cGYk.ico
cQIE.exe
cQcW.exe
cYcE.exe
ccsS.exe
csgg.exe
eAEY.exe
eAYK.exe
eEYK.exe
eMAs.exe
eQYi.exe
eUIg.exe
eUIy.exe
eYgw.exe
ewQe.exe
ewgI.ico
ewwg.exe
file.vbs
gAIu.exe
gEoo.exe
gMsA.exe
gQME.exe
gQki.exe
gYcc.ico
gkUs.exe
iAUk.exe
iIoG.exe
iOoc.ico
iQkE.exe
iQwq.exe
igYC.exe
ikIY.exe
isAG.exe
isku.exe
ksYa.exe
kuEE.ico
kwwQ.exe
mMgE.exe
mQYq.exe
mUMG.exe
mgoC.exe
mkEQ.ico
oAAS.exe
oAcs.exe
oIUu.exe
oMIg.exe
oMke.exe
oMoI.exe
oYUs.exe
oYcC.exe
okUE.exe
oswc.exe
qCkc.ico
qQou.exe
qUIa.exe
qkAE.exe
qkoW.exe
sIkc.ico
sQwu.exe
sUQk.exe
sUYw.exe
sgka.exe
sows.exe
uAcc.exe
uIAu.exe
uUIE.exe
uYUw.exe
ugIk.exe
uocS.exe
wAAW.exe
wIgS.exe
wMUq.exe
wQAK.exe
wcgO.exe
wkIy.exe
wosA.exe
wsIE.exe
wwsA.exe
yAEm.exe
yAUm.exe
yMYi.exe
ygwA.exe
ykQE.exe
yswS.exe
lisooYoQ.exe
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
lisooYoQ.inf
memory/888-2480-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1320-154-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2496-2472-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2532-122-0x0000000000400000-0x0000000000624000-memory.dmp
memory/2560-2302-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2560-19-0x0000000000400000-0x0000000000590000-memory.dmp
memory/2960-78-0x0000000000400000-0x0000000000624000-memory.dmp
memory/3000-236-0x0000000000400000-0x0000000000624000-memory.dmp
memory/3312-198-0x0000000000400000-0x0000000000624000-memory.dmp
memory/3372-2294-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3372-14-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3536-52-0x0000000000400000-0x0000000000624000-memory.dmp
memory/3564-110-0x0000000000400000-0x0000000000624000-memory.dmp
memory/3692-245-0x0000000000400000-0x0000000000624000-memory.dmp
memory/3960-66-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4140-32-0x0000000002570000-0x0000000002590000-memory.dmp
memory/4140-31-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4140-0-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4140-1-0x0000000002570000-0x0000000002590000-memory.dmp
memory/4172-96-0x0000000000400000-0x0000000000624000-memory.dmp
memory/4884-2464-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5012-2318-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5020-226-0x0000000000400000-0x0000000000624000-memory.dmp
memory/5024-211-0x0000000000400000-0x0000000000624000-memory.dmp
memory/5204-167-0x0000000000400000-0x0000000000624000-memory.dmp
memory/5472-184-0x0000000000400000-0x0000000000624000-memory.dmp
memory/5812-1946-0x00000000021E0000-0x0000000002200000-memory.dmp
memory/5812-256-0x00000000021E0000-0x0000000002200000-memory.dmp
memory/5812-7-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5812-2286-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5884-2310-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5900-140-0x0000000000400000-0x0000000000624000-memory.dmp