Analysis
- max time kernel
96s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 13:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_3054f080afa3d094b084d1381371acce_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_3054f080afa3d094b084d1381371acce_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
13 signatures
150 seconds
General
- Target 2026-07-02_3054f080afa3d094b084d1381371acce_elex_mafia.exe
- Size 518KB
- Sample260702-qql7sact7l
- SHA256 14b44e33822d594f223c1cc40127a61893c6a45746a6201c002242088f461eb3
- MD5 3054f080afa3d094b084d1381371acce
- SHA1 b1dfc7153ad4fce08be0daa3313afc681b395931
- SHA512 8ea56f86ed4cec97b6a502ff5ee76bf84e7771519edf2cbc36292a84000d4ebdf04826d704ebce099073aea46b88378f13c8fc2fb23d02c976d47bfa460526f2
- SSDEEP 12288:Jf1yBOtIZdpH+IKe4USjSlzM6lE6aF1WWJKA8WZ087KQZx1B+NZ:JfcBzZdcIKpUQqzM6lmt8y7Px6N
- TLSH T15DB4F111B988C036E5D212348E25EB920D3A7CB5972694C77BC47ABE6FB13D1D6B8307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 2684 7D88.tmp 5424 7E82.tmp 5448 7F4D.tmp 4820 8018.tmp 5972 80A5.tmp 5684 8150.tmp 4188 821C.tmp 3864 8279.tmp 5148 8354.tmp 3752 83E1.tmp 2556 848D.tmp 3456 8587.tmp 3724 85F4.tmp 2696 86DE.tmp 2916 874C.tmp 2024 8817.tmp 1916 8875.tmp 3784 8940.tmp 1912 89AD.tmp 4284 8A0B.tmp 5116 8AA7.tmp 3736 8B05.tmp 5588 8BE0.tmp 3536 8C6C.tmp 684 8CDA.tmp 3416 8D95.tmp 1084 8E02.tmp 5608 8E70.tmp 240 8F1C.tmp 3620 8F99.tmp 2068 9006.tmp 6092 9083.tmp 5664 9110.tmp 3820 919C.tmp 1416 91FA.tmp 2588 9267.tmp 1508 92B6.tmp 5660 9333.tmp 912 93A0.tmp 2952 93FE.tmp 4156 945B.tmp 5976 94B9.tmp 1796 9527.tmp 5960 95C3.tmp 4348 9630.tmp 2796 968E.tmp 2704 970B.tmp 1160 9778.tmp 1184 9805.tmp 972 9863.tmp 1100 98D0.tmp 4176 992E.tmp 2528 99AB.tmp 2340 9A57.tmp 4832 9B12.tmp 5356 9BCE.tmp 3196 9C6A.tmp 6124 9D06.tmp 4180 9D74.tmp 5836 9DF1.tmp 5580 9E6E.tmp 4064 9F0A.tmp 2896 9FB6.tmp 2732 A062.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 230F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B82F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E683.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4685.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E91E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 429D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A10D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 116B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 284E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B06F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F577.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ED0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99AB.tmp - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{40333CC8-6EA9-4113-944A-6C0A874F31FA} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{F8E24CE8-E06D-4481-A908-F35F4C583A94} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4636 explorer.exe 4636 explorer.exe - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe Token: SeShutdownPrivilege 4636 explorer.exe Token: SeCreatePagefilePrivilege 4636 explorer.exe - Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 3580 sihost.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe - Suspicious use of SendNotifyMessage 38 IoCs
pid Process 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe 4636 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 6408 StartMenuExperienceHost.exe 4636 explorer.exe 6232 SearchHost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3220 wrote to memory of 2684 3220 2026-07-02_3054f080afa3d094b084d1381371acce_elex_mafia.exe 88 PID 2684 wrote to memory of 5424 2684 7D88.tmp 89 PID 5424 wrote to memory of 5448 5424 7E82.tmp 90 PID 5448 wrote to memory of 4820 5448 7F4D.tmp 91 PID 4820 wrote to memory of 5972 4820 8018.tmp 92 PID 5972 wrote to memory of 5684 5972 80A5.tmp 93 PID 5684 wrote to memory of 4188 5684 8150.tmp 94 PID 4188 wrote to memory of 3864 4188 821C.tmp 95 PID 3864 wrote to memory of 5148 3864 8279.tmp 96 PID 5148 wrote to memory of 3752 5148 8354.tmp 97 PID 3752 wrote to memory of 2556 3752 83E1.tmp 98 PID 2556 wrote to memory of 3456 2556 848D.tmp 99 PID 3456 wrote to memory of 3724 3456 8587.tmp 100 PID 3724 wrote to memory of 2696 3724 85F4.tmp 101 PID 2696 wrote to memory of 2916 2696 86DE.tmp 102 PID 2916 wrote to memory of 2024 2916 874C.tmp 103 PID 2024 wrote to memory of 1916 2024 8817.tmp 104 PID 1916 wrote to memory of 3784 1916 8875.tmp 105 PID 3784 wrote to memory of 1912 3784 8940.tmp 106 PID 1912 wrote to memory of 4284 1912 89AD.tmp 107 PID 4284 wrote to memory of 5116 4284 8A0B.tmp 108 PID 5116 wrote to memory of 3736 5116 8AA7.tmp 109 PID 3736 wrote to memory of 5588 3736 8B05.tmp 110 PID 5588 wrote to memory of 3536 5588 8BE0.tmp 111 PID 3536 wrote to memory of 684 3536 8C6C.tmp 112 PID 684 wrote to memory of 3416 684 8CDA.tmp 113 PID 3416 wrote to memory of 1084 3416 8D95.tmp 114 PID 1084 wrote to memory of 5608 1084 8E02.tmp 115 PID 5608 wrote to memory of 240 5608 8E70.tmp 116 PID 240 wrote to memory of 3620 240 8F1C.tmp 117 PID 3620 wrote to memory of 2068 3620 8F99.tmp 118 PID 2068 wrote to memory of 6092 2068 9006.tmp 119 PID 6092 wrote to memory of 5664 6092 9083.tmp 120 PID 5664 wrote to memory of 3820 5664 9110.tmp 121 PID 3820 wrote to memory of 1416 3820 919C.tmp 122 PID 1416 wrote to memory of 2588 1416 91FA.tmp 123 PID 2588 wrote to memory of 1508 2588 9267.tmp 124 PID 1508 wrote to memory of 5660 1508 92B6.tmp 125 PID 5660 wrote to memory of 912 5660 9333.tmp 126 PID 912 wrote to memory of 2952 912 93A0.tmp 127 PID 2952 wrote to memory of 4156 2952 93FE.tmp 128 PID 4156 wrote to memory of 5976 4156 945B.tmp 129 PID 5976 wrote to memory of 1796 5976 94B9.tmp 130 PID 1796 wrote to memory of 5960 1796 9527.tmp 131 PID 5960 wrote to memory of 4348 5960 95C3.tmp 132 PID 4348 wrote to memory of 2796 4348 9630.tmp 133 PID 2796 wrote to memory of 2704 2796 968E.tmp 134 PID 2704 wrote to memory of 1160 2704 970B.tmp 135 PID 1160 wrote to memory of 1184 1160 9778.tmp 136 PID 1184 wrote to memory of 972 1184 9805.tmp 137 PID 972 wrote to memory of 1100 972 9863.tmp 138 PID 1100 wrote to memory of 4176 1100 98D0.tmp 139 PID 4176 wrote to memory of 2528 4176 992E.tmp 140 PID 2528 wrote to memory of 2340 2528 99AB.tmp 141 PID 2340 wrote to memory of 4832 2340 9A57.tmp 142 PID 4832 wrote to memory of 5356 4832 9B12.tmp 143 PID 5356 wrote to memory of 3196 5356 9BCE.tmp 144 PID 3196 wrote to memory of 6124 3196 9C6A.tmp 145 PID 6124 wrote to memory of 4180 6124 9D06.tmp 146 PID 4180 wrote to memory of 5836 4180 9D74.tmp 147 PID 5836 wrote to memory of 5580 5836 9DF1.tmp 148 PID 5580 wrote to memory of 4064 5580 9E6E.tmp 149 PID 4064 wrote to memory of 2896 4064 9F0A.tmp 150 PID 2896 wrote to memory of 2732 2896 9FB6.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_3054f080afa3d094b084d1381371acce_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_3054f080afa3d094b084d1381371acce_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\7D88.tmp"C:\Users\Admin\AppData\Local\Temp\7D88.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\7E82.tmp"C:\Users\Admin\AppData\Local\Temp\7E82.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\821C.tmp"C:\Users\Admin\AppData\Local\Temp\821C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\8354.tmp"C:\Users\Admin\AppData\Local\Temp\8354.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\83E1.tmp"C:\Users\Admin\AppData\Local\Temp\83E1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\848D.tmp"C:\Users\Admin\AppData\Local\Temp\848D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\8587.tmp"C:\Users\Admin\AppData\Local\Temp\8587.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\85F4.tmp"C:\Users\Admin\AppData\Local\Temp\85F4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\86DE.tmp"C:\Users\Admin\AppData\Local\Temp\86DE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\874C.tmp"C:\Users\Admin\AppData\Local\Temp\874C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\8817.tmp"C:\Users\Admin\AppData\Local\Temp\8817.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\8875.tmp"C:\Users\Admin\AppData\Local\Temp\8875.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\8940.tmp"C:\Users\Admin\AppData\Local\Temp\8940.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\89AD.tmp"C:\Users\Admin\AppData\Local\Temp\89AD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\8B05.tmp"C:\Users\Admin\AppData\Local\Temp\8B05.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\8D95.tmp"C:\Users\Admin\AppData\Local\Temp\8D95.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\8E02.tmp"C:\Users\Admin\AppData\Local\Temp\8E02.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\8E70.tmp"C:\Users\Admin\AppData\Local\Temp\8E70.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\8F1C.tmp"C:\Users\Admin\AppData\Local\Temp\8F1C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\8F99.tmp"C:\Users\Admin\AppData\Local\Temp\8F99.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\9006.tmp"C:\Users\Admin\AppData\Local\Temp\9006.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\9083.tmp"C:\Users\Admin\AppData\Local\Temp\9083.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\9110.tmp"C:\Users\Admin\AppData\Local\Temp\9110.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\919C.tmp"C:\Users\Admin\AppData\Local\Temp\919C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\91FA.tmp"C:\Users\Admin\AppData\Local\Temp\91FA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\9267.tmp"C:\Users\Admin\AppData\Local\Temp\9267.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\92B6.tmp"C:\Users\Admin\AppData\Local\Temp\92B6.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\9333.tmp"C:\Users\Admin\AppData\Local\Temp\9333.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\93A0.tmp"C:\Users\Admin\AppData\Local\Temp\93A0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\93FE.tmp"C:\Users\Admin\AppData\Local\Temp\93FE.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\945B.tmp"C:\Users\Admin\AppData\Local\Temp\945B.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\94B9.tmp"C:\Users\Admin\AppData\Local\Temp\94B9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\9527.tmp"C:\Users\Admin\AppData\Local\Temp\9527.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\95C3.tmp"C:\Users\Admin\AppData\Local\Temp\95C3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\9630.tmp"C:\Users\Admin\AppData\Local\Temp\9630.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\968E.tmp"C:\Users\Admin\AppData\Local\Temp\968E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\9778.tmp"C:\Users\Admin\AppData\Local\Temp\9778.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\9805.tmp"C:\Users\Admin\AppData\Local\Temp\9805.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\9863.tmp"C:\Users\Admin\AppData\Local\Temp\9863.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\98D0.tmp"C:\Users\Admin\AppData\Local\Temp\98D0.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\992E.tmp"C:\Users\Admin\AppData\Local\Temp\992E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\99AB.tmp"C:\Users\Admin\AppData\Local\Temp\99AB.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\9A57.tmp"C:\Users\Admin\AppData\Local\Temp\9A57.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\9B12.tmp"C:\Users\Admin\AppData\Local\Temp\9B12.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\9BCE.tmp"C:\Users\Admin\AppData\Local\Temp\9BCE.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\9D06.tmp"C:\Users\Admin\AppData\Local\Temp\9D06.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\9D74.tmp"C:\Users\Admin\AppData\Local\Temp\9D74.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\A062.tmp"C:\Users\Admin\AppData\Local\Temp\A062.tmp"65⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\A10D.tmp"C:\Users\Admin\AppData\Local\Temp\A10D.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"67⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\A246.tmp"C:\Users\Admin\AppData\Local\Temp\A246.tmp"68⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"69⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\A35F.tmp"C:\Users\Admin\AppData\Local\Temp\A35F.tmp"70⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\A40B.tmp"C:\Users\Admin\AppData\Local\Temp\A40B.tmp"71⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\A498.tmp"C:\Users\Admin\AppData\Local\Temp\A498.tmp"72⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\A524.tmp"C:\Users\Admin\AppData\Local\Temp\A524.tmp"73⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"74⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"75⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"77⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"78⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"79⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\A90C.tmp"C:\Users\Admin\AppData\Local\Temp\A90C.tmp"80⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\A999.tmp"C:\Users\Admin\AppData\Local\Temp\A999.tmp"81⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\AA16.tmp"C:\Users\Admin\AppData\Local\Temp\AA16.tmp"82⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\AAA3.tmp"C:\Users\Admin\AppData\Local\Temp\AAA3.tmp"83⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\AB10.tmp"C:\Users\Admin\AppData\Local\Temp\AB10.tmp"84⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\AB6E.tmp"C:\Users\Admin\AppData\Local\Temp\AB6E.tmp"85⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\AC58.tmp"C:\Users\Admin\AppData\Local\Temp\AC58.tmp"87⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"88⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\AD62.tmp"C:\Users\Admin\AppData\Local\Temp\AD62.tmp"89⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"90⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"91⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\AEE8.tmp"C:\Users\Admin\AppData\Local\Temp\AEE8.tmp"92⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\AF75.tmp"C:\Users\Admin\AppData\Local\Temp\AF75.tmp"93⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"94⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\B06F.tmp"C:\Users\Admin\AppData\Local\Temp\B06F.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\B12A.tmp"C:\Users\Admin\AppData\Local\Temp\B12A.tmp"96⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\B1D6.tmp"C:\Users\Admin\AppData\Local\Temp\B1D6.tmp"97⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\B253.tmp"C:\Users\Admin\AppData\Local\Temp\B253.tmp"98⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"99⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\B37C.tmp"C:\Users\Admin\AppData\Local\Temp\B37C.tmp"100⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\B418.tmp"C:\Users\Admin\AppData\Local\Temp\B418.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\B522.tmp"C:\Users\Admin\AppData\Local\Temp\B522.tmp"103⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\B65B.tmp"C:\Users\Admin\AppData\Local\Temp\B65B.tmp"105⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\B6D8.tmp"C:\Users\Admin\AppData\Local\Temp\B6D8.tmp"106⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\B745.tmp"C:\Users\Admin\AppData\Local\Temp\B745.tmp"107⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"108⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\B82F.tmp"C:\Users\Admin\AppData\Local\Temp\B82F.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\B89D.tmp"C:\Users\Admin\AppData\Local\Temp\B89D.tmp"110⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\B929.tmp"C:\Users\Admin\AppData\Local\Temp\B929.tmp"111⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"112⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\BA23.tmp"C:\Users\Admin\AppData\Local\Temp\BA23.tmp"113⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\BADF.tmp"C:\Users\Admin\AppData\Local\Temp\BADF.tmp"114⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\BB4C.tmp"C:\Users\Admin\AppData\Local\Temp\BB4C.tmp"115⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\BC65.tmp"C:\Users\Admin\AppData\Local\Temp\BC65.tmp"117⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\BD02.tmp"C:\Users\Admin\AppData\Local\Temp\BD02.tmp"118⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"119⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"120⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"121⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\BF25.tmp"C:\Users\Admin\AppData\Local\Temp\BF25.tmp"122⤵PID:6076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-