Analysis
- max time kernel
99s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 15:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-26_66ecf02f87e0df887b402599e78c3510_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_66ecf02f87e0df887b402599e78c3510_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
13 signatures
150 seconds
General
- Target 2026-06-26_66ecf02f87e0df887b402599e78c3510_elex_mafia.exe
- Size 560KB
- Sample260629-styfbsat4j
- SHA256 1f768e34ac8e878f9253515c3d3f6dabd84cff496bd5a73aa81d286a2130b7cf
- MD5 66ecf02f87e0df887b402599e78c3510
- SHA1 0507763967a7f9a92520382506a23cbef87f77aa
- SHA512 c76f38b4a9ecb47b796e94e96eca7e644657588b18fc2f190d57e9baad2b19f74919fe7018259200ea5cfdf00135b291839df3cf2e49b4c85c1abee5b7657313
- SSDEEP 12288:MlFXOQUDmrC8SRTysX7Lu1a/6c0H3uasHkqswsXAa3IZxV:MlUQbC8Sx/u1aSc0XuRHkqHa3IR
- TLSH T106C4F0127184C073E59212304A56DBA16B3F7C359B29A5C73B94267EAFF43D2E63834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 3148 993D.tmp 5704 9A66.tmp 5252 9B80.tmp 2680 9C7A.tmp 3436 9D35.tmp 4420 9DE1.tmp 948 9F0A.tmp 4832 A013.tmp 1200 A12D.tmp 1424 A217.tmp 4956 A301.tmp 5904 A3EC.tmp 3196 A505.tmp 932 A60F.tmp 4340 A718.tmp 2376 A803.tmp 4288 A91C.tmp 2760 AA74.tmp 2268 ABBC.tmp 1992 ACA6.tmp 5664 ADCF.tmp 1848 AEAA.tmp 3308 AFC3.tmp 1092 B0FC.tmp 3288 B205.tmp 4092 B2F0.tmp 236 B409.tmp 4984 B512.tmp 1380 B5BE.tmp 1844 B689.tmp 1756 B7B2.tmp 4976 B89D.tmp 5304 B9A6.tmp 4080 BA71.tmp 4568 BB5C.tmp 3616 BC56.tmp 4284 BD40.tmp 5052 BDCD.tmp 596 BEB7.tmp 1304 BF82.tmp 5940 C08C.tmp 2420 C176.tmp 6064 C203.tmp 2088 C29F.tmp 1476 C35B.tmp 3180 C416.tmp 4828 C510.tmp 2412 C5DB.tmp 5364 C697.tmp 5636 C714.tmp 2832 C791.tmp 2568 C81D.tmp 4160 C89A.tmp 5144 C937.tmp 980 C9C3.tmp 5932 CA31.tmp 2980 CABD.tmp 4576 CB4A.tmp 2604 CBC7.tmp 5420 CC44.tmp 1132 CCD1.tmp 5844 CD5D.tmp 3424 CDEA.tmp 3160 CE76.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E124.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5097.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 674B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8081.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C26C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 188F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E01A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25BE.tmp - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 35 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{9B01B93D-6CE5-454C-A286-D733189365DF} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{B60EBEFC-AF36-40B4-AC37-C372774A84B7} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe Token: SeShutdownPrivilege 3352 explorer.exe Token: SeCreatePagefilePrivilege 3352 explorer.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 2084 sihost.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe 3352 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4344 StartMenuExperienceHost.exe 704 SearchHost.exe 3352 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 3148 2964 2026-06-26_66ecf02f87e0df887b402599e78c3510_elex_mafia.exe 87 PID 3148 wrote to memory of 5704 3148 993D.tmp 88 PID 5704 wrote to memory of 5252 5704 9A66.tmp 89 PID 5252 wrote to memory of 2680 5252 9B80.tmp 90 PID 2680 wrote to memory of 3436 2680 9C7A.tmp 91 PID 3436 wrote to memory of 4420 3436 9D35.tmp 92 PID 4420 wrote to memory of 948 4420 9DE1.tmp 93 PID 948 wrote to memory of 4832 948 9F0A.tmp 94 PID 4832 wrote to memory of 1200 4832 A013.tmp 95 PID 1200 wrote to memory of 1424 1200 A12D.tmp 96 PID 1424 wrote to memory of 4956 1424 A217.tmp 97 PID 4956 wrote to memory of 5904 4956 A301.tmp 98 PID 5904 wrote to memory of 3196 5904 A3EC.tmp 99 PID 3196 wrote to memory of 932 3196 A505.tmp 100 PID 932 wrote to memory of 4340 932 A60F.tmp 101 PID 4340 wrote to memory of 2376 4340 A718.tmp 102 PID 2376 wrote to memory of 4288 2376 A803.tmp 103 PID 4288 wrote to memory of 2760 4288 A91C.tmp 104 PID 2760 wrote to memory of 2268 2760 AA74.tmp 105 PID 2268 wrote to memory of 1992 2268 ABBC.tmp 106 PID 1992 wrote to memory of 5664 1992 ACA6.tmp 107 PID 5664 wrote to memory of 1848 5664 ADCF.tmp 108 PID 1848 wrote to memory of 3308 1848 AEAA.tmp 109 PID 3308 wrote to memory of 1092 3308 AFC3.tmp 110 PID 1092 wrote to memory of 3288 1092 B0FC.tmp 111 PID 3288 wrote to memory of 4092 3288 B205.tmp 112 PID 4092 wrote to memory of 236 4092 B2F0.tmp 113 PID 236 wrote to memory of 4984 236 B409.tmp 114 PID 4984 wrote to memory of 1380 4984 B512.tmp 115 PID 1380 wrote to memory of 1844 1380 B5BE.tmp 116 PID 1844 wrote to memory of 1756 1844 B689.tmp 117 PID 1756 wrote to memory of 4976 1756 B7B2.tmp 118 PID 4976 wrote to memory of 5304 4976 B89D.tmp 119 PID 5304 wrote to memory of 4080 5304 B9A6.tmp 120 PID 4080 wrote to memory of 4568 4080 BA71.tmp 121 PID 4568 wrote to memory of 3616 4568 BB5C.tmp 122 PID 3616 wrote to memory of 4284 3616 BC56.tmp 123 PID 4284 wrote to memory of 5052 4284 BD40.tmp 124 PID 5052 wrote to memory of 596 5052 BDCD.tmp 125 PID 596 wrote to memory of 1304 596 BEB7.tmp 126 PID 1304 wrote to memory of 5940 1304 BF82.tmp 127 PID 5940 wrote to memory of 2420 5940 C08C.tmp 128 PID 2420 wrote to memory of 6064 2420 C176.tmp 129 PID 6064 wrote to memory of 2088 6064 C203.tmp 130 PID 2088 wrote to memory of 1476 2088 C29F.tmp 131 PID 1476 wrote to memory of 3180 1476 C35B.tmp 132 PID 3180 wrote to memory of 4828 3180 C416.tmp 133 PID 4828 wrote to memory of 2412 4828 C510.tmp 134 PID 2412 wrote to memory of 5364 2412 C5DB.tmp 135 PID 5364 wrote to memory of 5636 5364 C697.tmp 136 PID 5636 wrote to memory of 2832 5636 C714.tmp 137 PID 2832 wrote to memory of 2568 2832 C791.tmp 138 PID 2568 wrote to memory of 4160 2568 C81D.tmp 139 PID 4160 wrote to memory of 5144 4160 C89A.tmp 140 PID 5144 wrote to memory of 980 5144 C937.tmp 141 PID 980 wrote to memory of 5932 980 C9C3.tmp 142 PID 5932 wrote to memory of 2980 5932 CA31.tmp 143 PID 2980 wrote to memory of 4576 2980 CABD.tmp 144 PID 4576 wrote to memory of 2604 4576 CB4A.tmp 145 PID 2604 wrote to memory of 5420 2604 CBC7.tmp 146 PID 5420 wrote to memory of 1132 5420 CC44.tmp 147 PID 1132 wrote to memory of 5844 1132 CCD1.tmp 148 PID 5844 wrote to memory of 3424 5844 CD5D.tmp 149 PID 3424 wrote to memory of 3160 3424 CDEA.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_66ecf02f87e0df887b402599e78c3510_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_66ecf02f87e0df887b402599e78c3510_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\993D.tmp"C:\Users\Admin\AppData\Local\Temp\993D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\9A66.tmp"C:\Users\Admin\AppData\Local\Temp\9A66.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\9B80.tmp"C:\Users\Admin\AppData\Local\Temp\9B80.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\9D35.tmp"C:\Users\Admin\AppData\Local\Temp\9D35.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\A013.tmp"C:\Users\Admin\AppData\Local\Temp\A013.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\A12D.tmp"C:\Users\Admin\AppData\Local\Temp\A12D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\A217.tmp"C:\Users\Admin\AppData\Local\Temp\A217.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\A301.tmp"C:\Users\Admin\AppData\Local\Temp\A301.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\A505.tmp"C:\Users\Admin\AppData\Local\Temp\A505.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\A803.tmp"C:\Users\Admin\AppData\Local\Temp\A803.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\A91C.tmp"C:\Users\Admin\AppData\Local\Temp\A91C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\AA74.tmp"C:\Users\Admin\AppData\Local\Temp\AA74.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\B205.tmp"C:\Users\Admin\AppData\Local\Temp\B205.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\B2F0.tmp"C:\Users\Admin\AppData\Local\Temp\B2F0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\B409.tmp"C:\Users\Admin\AppData\Local\Temp\B409.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\B512.tmp"C:\Users\Admin\AppData\Local\Temp\B512.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\B5BE.tmp"C:\Users\Admin\AppData\Local\Temp\B5BE.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\B689.tmp"C:\Users\Admin\AppData\Local\Temp\B689.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\B89D.tmp"C:\Users\Admin\AppData\Local\Temp\B89D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\B9A6.tmp"C:\Users\Admin\AppData\Local\Temp\B9A6.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\BA71.tmp"C:\Users\Admin\AppData\Local\Temp\BA71.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\BC56.tmp"C:\Users\Admin\AppData\Local\Temp\BC56.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\BD40.tmp"C:\Users\Admin\AppData\Local\Temp\BD40.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\BF82.tmp"C:\Users\Admin\AppData\Local\Temp\BF82.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\C08C.tmp"C:\Users\Admin\AppData\Local\Temp\C08C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\C176.tmp"C:\Users\Admin\AppData\Local\Temp\C176.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\C203.tmp"C:\Users\Admin\AppData\Local\Temp\C203.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\C29F.tmp"C:\Users\Admin\AppData\Local\Temp\C29F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\C35B.tmp"C:\Users\Admin\AppData\Local\Temp\C35B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\C510.tmp"C:\Users\Admin\AppData\Local\Temp\C510.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\C697.tmp"C:\Users\Admin\AppData\Local\Temp\C697.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\C714.tmp"C:\Users\Admin\AppData\Local\Temp\C714.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\C791.tmp"C:\Users\Admin\AppData\Local\Temp\C791.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\C81D.tmp"C:\Users\Admin\AppData\Local\Temp\C81D.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\C89A.tmp"C:\Users\Admin\AppData\Local\Temp\C89A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\C937.tmp"C:\Users\Admin\AppData\Local\Temp\C937.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\CA31.tmp"C:\Users\Admin\AppData\Local\Temp\CA31.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\CABD.tmp"C:\Users\Admin\AppData\Local\Temp\CABD.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\CDEA.tmp"C:\Users\Admin\AppData\Local\Temp\CDEA.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"65⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\CF03.tmp"C:\Users\Admin\AppData\Local\Temp\CF03.tmp"66⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"67⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\D05B.tmp"C:\Users\Admin\AppData\Local\Temp\D05B.tmp"68⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"69⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"70⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\D24F.tmp"C:\Users\Admin\AppData\Local\Temp\D24F.tmp"71⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"72⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\D397.tmp"C:\Users\Admin\AppData\Local\Temp\D397.tmp"73⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\D424.tmp"C:\Users\Admin\AppData\Local\Temp\D424.tmp"74⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"75⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\D53D.tmp"C:\Users\Admin\AppData\Local\Temp\D53D.tmp"76⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"77⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\D675.tmp"C:\Users\Admin\AppData\Local\Temp\D675.tmp"78⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"80⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"81⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\D879.tmp"C:\Users\Admin\AppData\Local\Temp\D879.tmp"82⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"83⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\D992.tmp"C:\Users\Admin\AppData\Local\Temp\D992.tmp"84⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\DA00.tmp"C:\Users\Admin\AppData\Local\Temp\DA00.tmp"85⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"86⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\DB28.tmp"C:\Users\Admin\AppData\Local\Temp\DB28.tmp"87⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"88⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\DC32.tmp"C:\Users\Admin\AppData\Local\Temp\DC32.tmp"89⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"90⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"91⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\DE07.tmp"C:\Users\Admin\AppData\Local\Temp\DE07.tmp"92⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\DE93.tmp"C:\Users\Admin\AppData\Local\Temp\DE93.tmp"93⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\DF10.tmp"C:\Users\Admin\AppData\Local\Temp\DF10.tmp"94⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\DF8D.tmp"C:\Users\Admin\AppData\Local\Temp\DF8D.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\E01A.tmp"C:\Users\Admin\AppData\Local\Temp\E01A.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\E097.tmp"C:\Users\Admin\AppData\Local\Temp\E097.tmp"97⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\E124.tmp"C:\Users\Admin\AppData\Local\Temp\E124.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:456 -
C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"99⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\E22D.tmp"C:\Users\Admin\AppData\Local\Temp\E22D.tmp"100⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"101⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\E356.tmp"C:\Users\Admin\AppData\Local\Temp\E356.tmp"102⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\E3E3.tmp"C:\Users\Admin\AppData\Local\Temp\E3E3.tmp"103⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\E46F.tmp"C:\Users\Admin\AppData\Local\Temp\E46F.tmp"104⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"105⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\E569.tmp"C:\Users\Admin\AppData\Local\Temp\E569.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\E5F6.tmp"C:\Users\Admin\AppData\Local\Temp\E5F6.tmp"107⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\E663.tmp"C:\Users\Admin\AppData\Local\Temp\E663.tmp"108⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\E70F.tmp"C:\Users\Admin\AppData\Local\Temp\E70F.tmp"109⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\E78C.tmp"C:\Users\Admin\AppData\Local\Temp\E78C.tmp"110⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\E829.tmp"C:\Users\Admin\AppData\Local\Temp\E829.tmp"111⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"112⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\E951.tmp"C:\Users\Admin\AppData\Local\Temp\E951.tmp"113⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"114⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\EA6B.tmp"C:\Users\Admin\AppData\Local\Temp\EA6B.tmp"115⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\EAD8.tmp"C:\Users\Admin\AppData\Local\Temp\EAD8.tmp"116⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\EB74.tmp"C:\Users\Admin\AppData\Local\Temp\EB74.tmp"117⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"118⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\EC7E.tmp"C:\Users\Admin\AppData\Local\Temp\EC7E.tmp"119⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"120⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"121⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\EE53.tmp"C:\Users\Admin\AppData\Local\Temp\EE53.tmp"122⤵PID:1040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-