Analysis
- max time kernel
78s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 16:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_d71fbddbcc26e32788f40af2502ac4e3_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_d71fbddbcc26e32788f40af2502ac4e3_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
13 signatures
150 seconds
General
- Target 2026-07-02_d71fbddbcc26e32788f40af2502ac4e3_elex_mafia.exe
- Size 521KB
- Sample260702-twelnshw8v
- SHA256 09c7e9462c24dc21bed35dd446218b18ec5e6f9c01a683cb458ef63b944fa2d0
- MD5 d71fbddbcc26e32788f40af2502ac4e3
- SHA1 8f14420deb6500d98f882319c838aa14fb0d93d2
- SHA512 e98cf853b8576442431b78878e0092cb5b5438b38bc7f4578f0e2a15690f995790390326a69a7c4455bf25a047c9739f7d8a56ada9b7ff932291d62c66a4dec9
- SSDEEP 12288:gOlvWUTES1qjdwuUatUUEW3hMD7RxhL83L/OCJi6AEoRuNZi:gOkU/1qtmUEW3hMThL8iCuVkNg
- TLSH T10FB4E011B689C032E1D315314BA6EBA21C3FBD619B2A54C76B94263DAFF03C0D6B9717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 1376 19A8.tmp 1604 1A35.tmp 3988 1B4E.tmp 5736 1C29.tmp 4600 1D13.tmp 3984 1DFE.tmp 1752 1EB9.tmp 3216 1F56.tmp 2752 2011.tmp 824 210B.tmp 3944 21A7.tmp 3520 2244.tmp 612 232E.tmp 2024 23F9.tmp 5860 24C4.tmp 5756 2580.tmp 5184 260C.tmp 4840 26A9.tmp 2960 2764.tmp 5156 2810.tmp 5880 28FA.tmp 1880 29B6.tmp 5252 2A71.tmp 4844 2B8B.tmp 844 2C17.tmp 1672 2CC3.tmp 5824 2D7F.tmp 3708 2E3A.tmp 2120 2EF6.tmp 3884 2FA1.tmp 2640 306D.tmp 124 3118.tmp 2016 31C4.tmp 1284 3241.tmp 2064 32AF.tmp 2384 332C.tmp 4536 3399.tmp 4276 3406.tmp 4824 3493.tmp 5040 3510.tmp 5592 358D.tmp 928 35FA.tmp 2168 36A6.tmp 3404 3723.tmp 3180 37C0.tmp 4896 384C.tmp 2940 38C9.tmp 1860 3956.tmp 588 39F2.tmp 3836 3A5F.tmp 3208 3AEC.tmp 2848 3B79.tmp 4340 3BE6.tmp 4768 3C63.tmp 5600 3CF0.tmp 1872 3D6D.tmp 4524 3DF9.tmp 6132 3E86.tmp 4456 3F22.tmp 2944 3FBE.tmp 1596 405B.tmp 3292 40E7.tmp 5952 4193.tmp 796 4220.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6884.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9409.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5385.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5971.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 616F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4627.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_d71fbddbcc26e32788f40af2502ac4e3_elex_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F776.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 551B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B22F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C654.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4397.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 967A.tmp - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{5824BD99-FF8B-4DBD-8B7E-5605CB2AFBB3} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{E9C87190-B142-4198-89BF-EF89F3E940E9} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3636 explorer.exe 3636 explorer.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe Token: SeShutdownPrivilege 3636 explorer.exe Token: SeCreatePagefilePrivilege 3636 explorer.exe - Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 3240 sihost.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe - Suspicious use of SendNotifyMessage 38 IoCs
pid Process 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe 3636 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1132 StartMenuExperienceHost.exe 5552 SearchHost.exe 3636 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5848 wrote to memory of 1376 5848 2026-07-02_d71fbddbcc26e32788f40af2502ac4e3_elex_mafia.exe 88 PID 1376 wrote to memory of 1604 1376 19A8.tmp 89 PID 1604 wrote to memory of 3988 1604 1A35.tmp 90 PID 3988 wrote to memory of 5736 3988 1B4E.tmp 91 PID 5736 wrote to memory of 4600 5736 1C29.tmp 92 PID 4600 wrote to memory of 3984 4600 1D13.tmp 93 PID 3984 wrote to memory of 1752 3984 1DFE.tmp 94 PID 1752 wrote to memory of 3216 1752 1EB9.tmp 95 PID 3216 wrote to memory of 2752 3216 1F56.tmp 96 PID 2752 wrote to memory of 824 2752 2011.tmp 97 PID 824 wrote to memory of 3944 824 210B.tmp 98 PID 3944 wrote to memory of 3520 3944 21A7.tmp 99 PID 3520 wrote to memory of 612 3520 2244.tmp 100 PID 612 wrote to memory of 2024 612 232E.tmp 101 PID 2024 wrote to memory of 5860 2024 23F9.tmp 102 PID 5860 wrote to memory of 5756 5860 24C4.tmp 103 PID 5756 wrote to memory of 5184 5756 2580.tmp 104 PID 5184 wrote to memory of 4840 5184 260C.tmp 105 PID 4840 wrote to memory of 2960 4840 26A9.tmp 106 PID 2960 wrote to memory of 5156 2960 2764.tmp 107 PID 5156 wrote to memory of 5880 5156 2810.tmp 108 PID 5880 wrote to memory of 1880 5880 28FA.tmp 109 PID 1880 wrote to memory of 5252 1880 29B6.tmp 110 PID 5252 wrote to memory of 4844 5252 2A71.tmp 111 PID 4844 wrote to memory of 844 4844 2B8B.tmp 112 PID 844 wrote to memory of 1672 844 2C17.tmp 113 PID 1672 wrote to memory of 5824 1672 2CC3.tmp 114 PID 5824 wrote to memory of 3708 5824 2D7F.tmp 115 PID 3708 wrote to memory of 2120 3708 2E3A.tmp 116 PID 2120 wrote to memory of 3884 2120 2EF6.tmp 117 PID 3884 wrote to memory of 2640 3884 2FA1.tmp 118 PID 2640 wrote to memory of 124 2640 306D.tmp 119 PID 124 wrote to memory of 2016 124 3118.tmp 120 PID 2016 wrote to memory of 1284 2016 31C4.tmp 121 PID 1284 wrote to memory of 2064 1284 3241.tmp 122 PID 2064 wrote to memory of 2384 2064 32AF.tmp 123 PID 2384 wrote to memory of 4536 2384 332C.tmp 124 PID 4536 wrote to memory of 4276 4536 3399.tmp 125 PID 4276 wrote to memory of 4824 4276 3406.tmp 126 PID 4824 wrote to memory of 5040 4824 3493.tmp 127 PID 5040 wrote to memory of 5592 5040 3510.tmp 128 PID 5592 wrote to memory of 928 5592 358D.tmp 129 PID 928 wrote to memory of 2168 928 35FA.tmp 130 PID 2168 wrote to memory of 3404 2168 36A6.tmp 131 PID 3404 wrote to memory of 3180 3404 3723.tmp 132 PID 3180 wrote to memory of 4896 3180 37C0.tmp 133 PID 4896 wrote to memory of 2940 4896 384C.tmp 134 PID 2940 wrote to memory of 1860 2940 38C9.tmp 135 PID 1860 wrote to memory of 588 1860 3956.tmp 136 PID 588 wrote to memory of 3836 588 39F2.tmp 137 PID 3836 wrote to memory of 3208 3836 3A5F.tmp 138 PID 3208 wrote to memory of 2848 3208 3AEC.tmp 139 PID 2848 wrote to memory of 4340 2848 3B79.tmp 140 PID 4340 wrote to memory of 4768 4340 3BE6.tmp 141 PID 4768 wrote to memory of 5600 4768 3C63.tmp 142 PID 5600 wrote to memory of 1872 5600 3CF0.tmp 143 PID 1872 wrote to memory of 4524 1872 3D6D.tmp 144 PID 4524 wrote to memory of 6132 4524 3DF9.tmp 145 PID 6132 wrote to memory of 4456 6132 3E86.tmp 146 PID 4456 wrote to memory of 2944 4456 3F22.tmp 147 PID 2944 wrote to memory of 1596 2944 3FBE.tmp 148 PID 1596 wrote to memory of 3292 1596 405B.tmp 149 PID 3292 wrote to memory of 5952 3292 40E7.tmp 150 PID 5952 wrote to memory of 796 5952 4193.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_d71fbddbcc26e32788f40af2502ac4e3_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_d71fbddbcc26e32788f40af2502ac4e3_elex_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\1C29.tmp"C:\Users\Admin\AppData\Local\Temp\1C29.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\1D13.tmp"C:\Users\Admin\AppData\Local\Temp\1D13.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\1DFE.tmp"C:\Users\Admin\AppData\Local\Temp\1DFE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\1EB9.tmp"C:\Users\Admin\AppData\Local\Temp\1EB9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\1F56.tmp"C:\Users\Admin\AppData\Local\Temp\1F56.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\2011.tmp"C:\Users\Admin\AppData\Local\Temp\2011.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\210B.tmp"C:\Users\Admin\AppData\Local\Temp\210B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\21A7.tmp"C:\Users\Admin\AppData\Local\Temp\21A7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\2244.tmp"C:\Users\Admin\AppData\Local\Temp\2244.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\232E.tmp"C:\Users\Admin\AppData\Local\Temp\232E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\23F9.tmp"C:\Users\Admin\AppData\Local\Temp\23F9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\2580.tmp"C:\Users\Admin\AppData\Local\Temp\2580.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\260C.tmp"C:\Users\Admin\AppData\Local\Temp\260C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\26A9.tmp"C:\Users\Admin\AppData\Local\Temp\26A9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\2764.tmp"C:\Users\Admin\AppData\Local\Temp\2764.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\2810.tmp"C:\Users\Admin\AppData\Local\Temp\2810.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\28FA.tmp"C:\Users\Admin\AppData\Local\Temp\28FA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\29B6.tmp"C:\Users\Admin\AppData\Local\Temp\29B6.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\2A71.tmp"C:\Users\Admin\AppData\Local\Temp\2A71.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\2C17.tmp"C:\Users\Admin\AppData\Local\Temp\2C17.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\306D.tmp"C:\Users\Admin\AppData\Local\Temp\306D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3118.tmp"C:\Users\Admin\AppData\Local\Temp\3118.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\31C4.tmp"C:\Users\Admin\AppData\Local\Temp\31C4.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\3241.tmp"C:\Users\Admin\AppData\Local\Temp\3241.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\32AF.tmp"C:\Users\Admin\AppData\Local\Temp\32AF.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\332C.tmp"C:\Users\Admin\AppData\Local\Temp\332C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\3406.tmp"C:\Users\Admin\AppData\Local\Temp\3406.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\3493.tmp"C:\Users\Admin\AppData\Local\Temp\3493.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\3510.tmp"C:\Users\Admin\AppData\Local\Temp\3510.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\358D.tmp"C:\Users\Admin\AppData\Local\Temp\358D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\35FA.tmp"C:\Users\Admin\AppData\Local\Temp\35FA.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\36A6.tmp"C:\Users\Admin\AppData\Local\Temp\36A6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\3723.tmp"C:\Users\Admin\AppData\Local\Temp\3723.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\37C0.tmp"C:\Users\Admin\AppData\Local\Temp\37C0.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\384C.tmp"C:\Users\Admin\AppData\Local\Temp\384C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\38C9.tmp"C:\Users\Admin\AppData\Local\Temp\38C9.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\3956.tmp"C:\Users\Admin\AppData\Local\Temp\3956.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\39F2.tmp"C:\Users\Admin\AppData\Local\Temp\39F2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\3B79.tmp"C:\Users\Admin\AppData\Local\Temp\3B79.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\3C63.tmp"C:\Users\Admin\AppData\Local\Temp\3C63.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\405B.tmp"C:\Users\Admin\AppData\Local\Temp\405B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\4220.tmp"C:\Users\Admin\AppData\Local\Temp\4220.tmp"65⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\428D.tmp"C:\Users\Admin\AppData\Local\Temp\428D.tmp"66⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\430A.tmp"C:\Users\Admin\AppData\Local\Temp\430A.tmp"67⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\4397.tmp"C:\Users\Admin\AppData\Local\Temp\4397.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\4423.tmp"C:\Users\Admin\AppData\Local\Temp\4423.tmp"69⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\44A0.tmp"C:\Users\Admin\AppData\Local\Temp\44A0.tmp"70⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\451D.tmp"C:\Users\Admin\AppData\Local\Temp\451D.tmp"71⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\458B.tmp"C:\Users\Admin\AppData\Local\Temp\458B.tmp"72⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\4627.tmp"C:\Users\Admin\AppData\Local\Temp\4627.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\46C3.tmp"C:\Users\Admin\AppData\Local\Temp\46C3.tmp"74⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\4740.tmp"C:\Users\Admin\AppData\Local\Temp\4740.tmp"75⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\47BD.tmp"C:\Users\Admin\AppData\Local\Temp\47BD.tmp"76⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\482B.tmp"C:\Users\Admin\AppData\Local\Temp\482B.tmp"77⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\4898.tmp"C:\Users\Admin\AppData\Local\Temp\4898.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\4925.tmp"C:\Users\Admin\AppData\Local\Temp\4925.tmp"79⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\49C1.tmp"C:\Users\Admin\AppData\Local\Temp\49C1.tmp"80⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"81⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\4B09.tmp"C:\Users\Admin\AppData\Local\Temp\4B09.tmp"82⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\4B96.tmp"C:\Users\Admin\AppData\Local\Temp\4B96.tmp"83⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\4C22.tmp"C:\Users\Admin\AppData\Local\Temp\4C22.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"85⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"86⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\4D99.tmp"C:\Users\Admin\AppData\Local\Temp\4D99.tmp"87⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\4E16.tmp"C:\Users\Admin\AppData\Local\Temp\4E16.tmp"88⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"89⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\4FEB.tmp"C:\Users\Admin\AppData\Local\Temp\4FEB.tmp"91⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\5097.tmp"C:\Users\Admin\AppData\Local\Temp\5097.tmp"92⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\5124.tmp"C:\Users\Admin\AppData\Local\Temp\5124.tmp"93⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\51A1.tmp"C:\Users\Admin\AppData\Local\Temp\51A1.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\520E.tmp"C:\Users\Admin\AppData\Local\Temp\520E.tmp"95⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\528B.tmp"C:\Users\Admin\AppData\Local\Temp\528B.tmp"96⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\5308.tmp"C:\Users\Admin\AppData\Local\Temp\5308.tmp"97⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\5385.tmp"C:\Users\Admin\AppData\Local\Temp\5385.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\5421.tmp"C:\Users\Admin\AppData\Local\Temp\5421.tmp"99⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\549E.tmp"C:\Users\Admin\AppData\Local\Temp\549E.tmp"100⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\551B.tmp"C:\Users\Admin\AppData\Local\Temp\551B.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\55A8.tmp"C:\Users\Admin\AppData\Local\Temp\55A8.tmp"102⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\5644.tmp"C:\Users\Admin\AppData\Local\Temp\5644.tmp"103⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\5700.tmp"C:\Users\Admin\AppData\Local\Temp\5700.tmp"104⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\577D.tmp"C:\Users\Admin\AppData\Local\Temp\577D.tmp"105⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\5838.tmp"C:\Users\Admin\AppData\Local\Temp\5838.tmp"106⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\58F4.tmp"C:\Users\Admin\AppData\Local\Temp\58F4.tmp"107⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\5971.tmp"C:\Users\Admin\AppData\Local\Temp\5971.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\59EE.tmp"C:\Users\Admin\AppData\Local\Temp\59EE.tmp"109⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"110⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\5B07.tmp"C:\Users\Admin\AppData\Local\Temp\5B07.tmp"111⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\5B84.tmp"C:\Users\Admin\AppData\Local\Temp\5B84.tmp"112⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\5C01.tmp"C:\Users\Admin\AppData\Local\Temp\5C01.tmp"113⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"114⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\5CEB.tmp"C:\Users\Admin\AppData\Local\Temp\5CEB.tmp"115⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"116⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\5E33.tmp"C:\Users\Admin\AppData\Local\Temp\5E33.tmp"117⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"118⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"119⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\5FBA.tmp"C:\Users\Admin\AppData\Local\Temp\5FBA.tmp"120⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\6056.tmp"C:\Users\Admin\AppData\Local\Temp\6056.tmp"121⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\60E3.tmp"C:\Users\Admin\AppData\Local\Temp\60E3.tmp"122⤵PID:3320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-