Analysis
- max time kernel
72s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_f92991d6111414ec453136fd9ae5b00b_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_f92991d6111414ec453136fd9ae5b00b_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
13 signatures
150 seconds
General
- Target 2026-07-02_f92991d6111414ec453136fd9ae5b00b_elex_mafia.exe
- Size 521KB
- Sample260702-thvqqset7p
- SHA256 f25b89ad770b38ad06de4fa0b1e7bb523430e7439c44006530b111931946d33a
- MD5 f92991d6111414ec453136fd9ae5b00b
- SHA1 052663621f9ba6355322914ec9e6a64497b784f5
- SHA512 d359bfea72e8497912a1b0bcd09e669ab32c76bac82a6f069e9dac8d5d0404ffe3349e217254642f975297b510851f18cfd5abfb22aa2b7555ac97f13b9032bf
- SSDEEP 12288:gOlvWUTES1BjFnsgb77YEhgVL86QDQL5vunpjtNZi:gOkU/1RFv77/A86F9upxNg
- TLSH T1FDB4F021B248C033E1A205354B56EBA65C3F7C39AB26A5C77B94366E6FF02D0D6B4317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 1316 1330.tmp 3816 140B.tmp 3932 14E6.tmp 1424 15A1.tmp 956 160F.tmp 4464 1718.tmp 5340 1803.tmp 5640 1880.tmp 1332 190C.tmp 1292 19B8.tmp 4176 1A45.tmp 3124 1AD1.tmp 800 1B4E.tmp 5920 1C19.tmp 5072 1CE5.tmp 4704 1D90.tmp 4520 1E3C.tmp 4796 1EF8.tmp 3372 1F94.tmp 6036 2021.tmp 2800 20DC.tmp 1572 2188.tmp 4664 2205.tmp 1868 22A1.tmp 3668 235D.tmp 4412 2418.tmp 3664 24B5.tmp 5400 2580.tmp 5260 261C.tmp 2440 26D7.tmp 2052 2764.tmp 268 2820.tmp 2616 28DB.tmp 2516 2948.tmp 872 29D5.tmp 1752 2A52.tmp 5188 2ABF.tmp 2132 2B2D.tmp 5944 2BC9.tmp 4924 2C46.tmp 4952 2CD3.tmp 1776 2D50.tmp 2796 2DFC.tmp 1216 2E69.tmp 2100 2EE6.tmp 1920 2F53.tmp 5252 2FD0.tmp 5320 304D.tmp 3152 30BB.tmp 4848 3138.tmp 4236 31B5.tmp 5764 3232.tmp 5816 32AF.tmp 1032 331C.tmp 2344 33B8.tmp 2496 3426.tmp 5444 34A3.tmp 2744 3520.tmp 5848 358D.tmp 4984 3629.tmp 860 36B6.tmp 5564 3733.tmp 5984 37C0.tmp 5712 383D.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E054.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E43C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 403B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4760.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6865.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 502.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7258.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C20E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B07A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C99F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 818A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 835F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 742C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A03E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F65C.tmp - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{39558BD1-7DA8-47CB-914F-76981CF49ABA} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{F63D49BD-79C1-4A93-968B-19CF6188B1E7} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3920 explorer.exe 3920 explorer.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe Token: SeShutdownPrivilege 3920 explorer.exe Token: SeCreatePagefilePrivilege 3920 explorer.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 3672 sihost.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe 3920 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5548 StartMenuExperienceHost.exe 3348 SearchHost.exe 3920 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1172 wrote to memory of 1316 1172 2026-07-02_f92991d6111414ec453136fd9ae5b00b_elex_mafia.exe 87 PID 1316 wrote to memory of 3816 1316 1330.tmp 88 PID 3816 wrote to memory of 3932 3816 140B.tmp 89 PID 3932 wrote to memory of 1424 3932 14E6.tmp 90 PID 1424 wrote to memory of 956 1424 15A1.tmp 91 PID 956 wrote to memory of 4464 956 160F.tmp 92 PID 4464 wrote to memory of 5340 4464 1718.tmp 93 PID 5340 wrote to memory of 5640 5340 1803.tmp 94 PID 5640 wrote to memory of 1332 5640 1880.tmp 95 PID 1332 wrote to memory of 1292 1332 190C.tmp 96 PID 1292 wrote to memory of 4176 1292 19B8.tmp 97 PID 4176 wrote to memory of 3124 4176 1A45.tmp 98 PID 3124 wrote to memory of 800 3124 1AD1.tmp 99 PID 800 wrote to memory of 5920 800 1B4E.tmp 100 PID 5920 wrote to memory of 5072 5920 1C19.tmp 101 PID 5072 wrote to memory of 4704 5072 1CE5.tmp 102 PID 4704 wrote to memory of 4520 4704 1D90.tmp 103 PID 4520 wrote to memory of 4796 4520 1E3C.tmp 104 PID 4796 wrote to memory of 3372 4796 1EF8.tmp 105 PID 3372 wrote to memory of 6036 3372 1F94.tmp 106 PID 6036 wrote to memory of 2800 6036 2021.tmp 107 PID 2800 wrote to memory of 1572 2800 20DC.tmp 108 PID 1572 wrote to memory of 4664 1572 2188.tmp 109 PID 4664 wrote to memory of 1868 4664 2205.tmp 110 PID 1868 wrote to memory of 3668 1868 22A1.tmp 111 PID 3668 wrote to memory of 4412 3668 235D.tmp 112 PID 4412 wrote to memory of 3664 4412 2418.tmp 113 PID 3664 wrote to memory of 5400 3664 24B5.tmp 114 PID 5400 wrote to memory of 5260 5400 2580.tmp 115 PID 5260 wrote to memory of 2440 5260 261C.tmp 116 PID 2440 wrote to memory of 2052 2440 26D7.tmp 117 PID 2052 wrote to memory of 268 2052 2764.tmp 118 PID 268 wrote to memory of 2616 268 2820.tmp 119 PID 2616 wrote to memory of 2516 2616 28DB.tmp 120 PID 2516 wrote to memory of 872 2516 2948.tmp 121 PID 872 wrote to memory of 1752 872 29D5.tmp 122 PID 1752 wrote to memory of 5188 1752 2A52.tmp 123 PID 5188 wrote to memory of 2132 5188 2ABF.tmp 124 PID 2132 wrote to memory of 5944 2132 2B2D.tmp 125 PID 5944 wrote to memory of 4924 5944 2BC9.tmp 126 PID 4924 wrote to memory of 4952 4924 2C46.tmp 127 PID 4952 wrote to memory of 1776 4952 2CD3.tmp 128 PID 1776 wrote to memory of 2796 1776 2D50.tmp 129 PID 2796 wrote to memory of 1216 2796 2DFC.tmp 130 PID 1216 wrote to memory of 2100 1216 2E69.tmp 131 PID 2100 wrote to memory of 1920 2100 2EE6.tmp 132 PID 1920 wrote to memory of 5252 1920 2F53.tmp 133 PID 5252 wrote to memory of 5320 5252 2FD0.tmp 134 PID 5320 wrote to memory of 3152 5320 304D.tmp 135 PID 3152 wrote to memory of 4848 3152 30BB.tmp 136 PID 4848 wrote to memory of 4236 4848 3138.tmp 137 PID 4236 wrote to memory of 5764 4236 31B5.tmp 138 PID 5764 wrote to memory of 5816 5764 3232.tmp 139 PID 5816 wrote to memory of 1032 5816 32AF.tmp 140 PID 1032 wrote to memory of 2344 1032 331C.tmp 141 PID 2344 wrote to memory of 2496 2344 33B8.tmp 142 PID 2496 wrote to memory of 5444 2496 3426.tmp 143 PID 5444 wrote to memory of 2744 5444 34A3.tmp 144 PID 2744 wrote to memory of 5848 2744 3520.tmp 145 PID 5848 wrote to memory of 4984 5848 358D.tmp 146 PID 4984 wrote to memory of 860 4984 3629.tmp 147 PID 860 wrote to memory of 5564 860 36B6.tmp 148 PID 5564 wrote to memory of 5984 5564 3733.tmp 149 PID 5984 wrote to memory of 5712 5984 37C0.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_f92991d6111414ec453136fd9ae5b00b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_f92991d6111414ec453136fd9ae5b00b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\1330.tmp"C:\Users\Admin\AppData\Local\Temp\1330.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\140B.tmp"C:\Users\Admin\AppData\Local\Temp\140B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\14E6.tmp"C:\Users\Admin\AppData\Local\Temp\14E6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\160F.tmp"C:\Users\Admin\AppData\Local\Temp\160F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\1718.tmp"C:\Users\Admin\AppData\Local\Temp\1718.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\1C19.tmp"C:\Users\Admin\AppData\Local\Temp\1C19.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\1D90.tmp"C:\Users\Admin\AppData\Local\Temp\1D90.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\1F94.tmp"C:\Users\Admin\AppData\Local\Temp\1F94.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\20DC.tmp"C:\Users\Admin\AppData\Local\Temp\20DC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\2188.tmp"C:\Users\Admin\AppData\Local\Temp\2188.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\2205.tmp"C:\Users\Admin\AppData\Local\Temp\2205.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\22A1.tmp"C:\Users\Admin\AppData\Local\Temp\22A1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\235D.tmp"C:\Users\Admin\AppData\Local\Temp\235D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\2418.tmp"C:\Users\Admin\AppData\Local\Temp\2418.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\24B5.tmp"C:\Users\Admin\AppData\Local\Temp\24B5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\2580.tmp"C:\Users\Admin\AppData\Local\Temp\2580.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\261C.tmp"C:\Users\Admin\AppData\Local\Temp\261C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\26D7.tmp"C:\Users\Admin\AppData\Local\Temp\26D7.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\2764.tmp"C:\Users\Admin\AppData\Local\Temp\2764.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\28DB.tmp"C:\Users\Admin\AppData\Local\Temp\28DB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\2948.tmp"C:\Users\Admin\AppData\Local\Temp\2948.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\29D5.tmp"C:\Users\Admin\AppData\Local\Temp\29D5.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\2A52.tmp"C:\Users\Admin\AppData\Local\Temp\2A52.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\2B2D.tmp"C:\Users\Admin\AppData\Local\Temp\2B2D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\2BC9.tmp"C:\Users\Admin\AppData\Local\Temp\2BC9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\2C46.tmp"C:\Users\Admin\AppData\Local\Temp\2C46.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\2D50.tmp"C:\Users\Admin\AppData\Local\Temp\2D50.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2DFC.tmp"C:\Users\Admin\AppData\Local\Temp\2DFC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2E69.tmp"C:\Users\Admin\AppData\Local\Temp\2E69.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\2EE6.tmp"C:\Users\Admin\AppData\Local\Temp\2EE6.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2F53.tmp"C:\Users\Admin\AppData\Local\Temp\2F53.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\2FD0.tmp"C:\Users\Admin\AppData\Local\Temp\2FD0.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\304D.tmp"C:\Users\Admin\AppData\Local\Temp\304D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\30BB.tmp"C:\Users\Admin\AppData\Local\Temp\30BB.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\3138.tmp"C:\Users\Admin\AppData\Local\Temp\3138.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\31B5.tmp"C:\Users\Admin\AppData\Local\Temp\31B5.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\3232.tmp"C:\Users\Admin\AppData\Local\Temp\3232.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\32AF.tmp"C:\Users\Admin\AppData\Local\Temp\32AF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\33B8.tmp"C:\Users\Admin\AppData\Local\Temp\33B8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3426.tmp"C:\Users\Admin\AppData\Local\Temp\3426.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\34A3.tmp"C:\Users\Admin\AppData\Local\Temp\34A3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\3520.tmp"C:\Users\Admin\AppData\Local\Temp\3520.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\358D.tmp"C:\Users\Admin\AppData\Local\Temp\358D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\3629.tmp"C:\Users\Admin\AppData\Local\Temp\3629.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\36B6.tmp"C:\Users\Admin\AppData\Local\Temp\36B6.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\3733.tmp"C:\Users\Admin\AppData\Local\Temp\3733.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\37C0.tmp"C:\Users\Admin\AppData\Local\Temp\37C0.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"65⤵
- Executes dropped EXE
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\38BA.tmp"C:\Users\Admin\AppData\Local\Temp\38BA.tmp"66⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\3956.tmp"C:\Users\Admin\AppData\Local\Temp\3956.tmp"67⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\39D3.tmp"C:\Users\Admin\AppData\Local\Temp\39D3.tmp"68⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\3A50.tmp"C:\Users\Admin\AppData\Local\Temp\3A50.tmp"69⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"70⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\3B59.tmp"C:\Users\Admin\AppData\Local\Temp\3B59.tmp"71⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"72⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"73⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"74⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"75⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"76⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"77⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"78⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"79⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\403B.tmp"C:\Users\Admin\AppData\Local\Temp\403B.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\40A9.tmp"C:\Users\Admin\AppData\Local\Temp\40A9.tmp"81⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"82⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\41A3.tmp"C:\Users\Admin\AppData\Local\Temp\41A3.tmp"83⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\4220.tmp"C:\Users\Admin\AppData\Local\Temp\4220.tmp"84⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\429D.tmp"C:\Users\Admin\AppData\Local\Temp\429D.tmp"85⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\4329.tmp"C:\Users\Admin\AppData\Local\Temp\4329.tmp"86⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\43C6.tmp"C:\Users\Admin\AppData\Local\Temp\43C6.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\4433.tmp"C:\Users\Admin\AppData\Local\Temp\4433.tmp"88⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\44C0.tmp"C:\Users\Admin\AppData\Local\Temp\44C0.tmp"89⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"90⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\45D9.tmp"C:\Users\Admin\AppData\Local\Temp\45D9.tmp"91⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\4656.tmp"C:\Users\Admin\AppData\Local\Temp\4656.tmp"92⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\46C3.tmp"C:\Users\Admin\AppData\Local\Temp\46C3.tmp"93⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\4760.tmp"C:\Users\Admin\AppData\Local\Temp\4760.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\47DD.tmp"C:\Users\Admin\AppData\Local\Temp\47DD.tmp"95⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\485A.tmp"C:\Users\Admin\AppData\Local\Temp\485A.tmp"96⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\48F6.tmp"C:\Users\Admin\AppData\Local\Temp\48F6.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\4982.tmp"C:\Users\Admin\AppData\Local\Temp\4982.tmp"98⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\4A0F.tmp"C:\Users\Admin\AppData\Local\Temp\4A0F.tmp"99⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\4B19.tmp"C:\Users\Admin\AppData\Local\Temp\4B19.tmp"101⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\4B86.tmp"C:\Users\Admin\AppData\Local\Temp\4B86.tmp"102⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\4C03.tmp"C:\Users\Admin\AppData\Local\Temp\4C03.tmp"103⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\4C90.tmp"C:\Users\Admin\AppData\Local\Temp\4C90.tmp"104⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"105⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"106⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"107⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\4E45.tmp"C:\Users\Admin\AppData\Local\Temp\4E45.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"109⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"110⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"111⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\5087.tmp"C:\Users\Admin\AppData\Local\Temp\5087.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\5104.tmp"C:\Users\Admin\AppData\Local\Temp\5104.tmp"113⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\5172.tmp"C:\Users\Admin\AppData\Local\Temp\5172.tmp"114⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\51EF.tmp"C:\Users\Admin\AppData\Local\Temp\51EF.tmp"115⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\528B.tmp"C:\Users\Admin\AppData\Local\Temp\528B.tmp"116⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\5318.tmp"C:\Users\Admin\AppData\Local\Temp\5318.tmp"117⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\5395.tmp"C:\Users\Admin\AppData\Local\Temp\5395.tmp"118⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5412.tmp"C:\Users\Admin\AppData\Local\Temp\5412.tmp"119⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\549E.tmp"C:\Users\Admin\AppData\Local\Temp\549E.tmp"120⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\553A.tmp"C:\Users\Admin\AppData\Local\Temp\553A.tmp"121⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\55A8.tmp"C:\Users\Admin\AppData\Local\Temp\55A8.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-