Analysis
- max time kernel
73s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-06_48b0a22443787d5e2ed6546998466ffd_elex_mafia.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-06_48b0a22443787d5e2ed6546998466ffd_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
General
- Target 2026-07-06_48b0a22443787d5e2ed6546998466ffd_elex_mafia.exe
- Size 524KB
- Sample260706-spfdyscy4n
- SHA256 c0930bad8b57c68c40774d4b0a78258d224b4daf3322f4374d85459a44edd9db
- MD5 48b0a22443787d5e2ed6546998466ffd
- SHA1 c9d9125454050fa0e5f890fd4837446d56c299c2
- SHA512 94d044c9905d17efacb49aa7516500b59dbd8e45883d66d972d342f25b946170776ddc9c1eb485b88583eb31378249cd26e72ea8b0b1abd2f770d801778d2e99
- SSDEEP 12288:TRyZzqyL66T8ZGLFS0kkJrUuXf444AhvAAHiZNZ:TRyQylTOqLA4hGQWN
- TLSH T15DB4F0157684C432E69201368A1AEBA6593ABC75AB27A4CB3BD5363D6FF03C1D374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 4692 39A4.tmp 5844 3ADC.tmp 3960 3C53.tmp 872 3DEA.tmp 2476 3E86.tmp 4252 3FDE.tmp 4720 406A.tmp 2176 4193.tmp 2848 428D.tmp 5984 4368.tmp 2820 4491.tmp 904 457B.tmp 6100 46C3.tmp 4280 47AE.tmp 5708 4888.tmp 4632 4954.tmp 1636 4A8C.tmp 6000 4BB5.tmp 1900 4C9F.tmp 4488 4D7A.tmp 1892 4E45.tmp 5144 4F30.tmp 4828 501A.tmp 256 5152.tmp 5284 522D.tmp 2872 5308.tmp 2408 5412.tmp 4296 54CD.tmp 2036 55B7.tmp 2096 5700.tmp 1848 57FA.tmp 4356 5922.tmp 2392 5A4B.tmp 4844 5AE8.tmp 4180 5B65.tmp 5140 5BF1.tmp 2116 5C8D.tmp 4652 5D59.tmp 4388 5E24.tmp 5624 5F0E.tmp 3408 5F7B.tmp 5784 6095.tmp 2204 616F.tmp 3164 61FC.tmp 1112 62B8.tmp 476 6383.tmp 2568 641F.tmp 1196 64AC.tmp 1312 6548.tmp 984 65C5.tmp 2508 6642.tmp 5268 66EE.tmp 960 677A.tmp 1856 67F7.tmp 3740 6884.tmp 1472 6901.tmp 4904 698E.tmp 5320 6A0B.tmp 5812 6A88.tmp 1148 6B14.tmp 5660 6B82.tmp 3092 6C0E.tmp 2136 6C8B.tmp 2092 6CF9.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 837E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 515D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C385.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B27D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E833.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E15D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 275F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C46F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6548.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B03B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C70F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 540D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 773A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5545.tmp - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{F4C508F4-97EE-4A56-96C8-70CB3E3635AB} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{EA3375AB-48F5-461D-B61F-7E4E97806473} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5892 explorer.exe 5892 explorer.exe - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe Token: SeShutdownPrivilege 5892 explorer.exe Token: SeCreatePagefilePrivilege 5892 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 1080 sihost.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe 5892 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3824 SearchHost.exe 1704 StartMenuExperienceHost.exe 5892 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 4692 1996 2026-07-06_48b0a22443787d5e2ed6546998466ffd_elex_mafia.exe 88 PID 4692 wrote to memory of 5844 4692 39A4.tmp 89 PID 5844 wrote to memory of 3960 5844 3ADC.tmp 90 PID 3960 wrote to memory of 872 3960 3C53.tmp 91 PID 872 wrote to memory of 2476 872 3DEA.tmp 92 PID 2476 wrote to memory of 4252 2476 3E86.tmp 93 PID 4252 wrote to memory of 4720 4252 3FDE.tmp 94 PID 4720 wrote to memory of 2176 4720 406A.tmp 95 PID 2176 wrote to memory of 2848 2176 4193.tmp 96 PID 2848 wrote to memory of 5984 2848 428D.tmp 97 PID 5984 wrote to memory of 2820 5984 4368.tmp 98 PID 2820 wrote to memory of 904 2820 4491.tmp 99 PID 904 wrote to memory of 6100 904 457B.tmp 100 PID 6100 wrote to memory of 4280 6100 46C3.tmp 101 PID 4280 wrote to memory of 5708 4280 47AE.tmp 102 PID 5708 wrote to memory of 4632 5708 4888.tmp 103 PID 4632 wrote to memory of 1636 4632 4954.tmp 104 PID 1636 wrote to memory of 6000 1636 4A8C.tmp 105 PID 6000 wrote to memory of 1900 6000 4BB5.tmp 106 PID 1900 wrote to memory of 4488 1900 4C9F.tmp 107 PID 4488 wrote to memory of 1892 4488 4D7A.tmp 108 PID 1892 wrote to memory of 5144 1892 4E45.tmp 109 PID 5144 wrote to memory of 4828 5144 4F30.tmp 110 PID 4828 wrote to memory of 256 4828 501A.tmp 111 PID 256 wrote to memory of 5284 256 5152.tmp 112 PID 5284 wrote to memory of 2872 5284 522D.tmp 113 PID 2872 wrote to memory of 2408 2872 5308.tmp 114 PID 2408 wrote to memory of 4296 2408 5412.tmp 115 PID 4296 wrote to memory of 2036 4296 54CD.tmp 116 PID 2036 wrote to memory of 2096 2036 55B7.tmp 117 PID 2096 wrote to memory of 1848 2096 5700.tmp 118 PID 1848 wrote to memory of 4356 1848 57FA.tmp 119 PID 4356 wrote to memory of 2392 4356 5922.tmp 120 PID 2392 wrote to memory of 4844 2392 5A4B.tmp 121 PID 4844 wrote to memory of 4180 4844 5AE8.tmp 122 PID 4180 wrote to memory of 5140 4180 5B65.tmp 123 PID 5140 wrote to memory of 2116 5140 5BF1.tmp 124 PID 2116 wrote to memory of 4652 2116 5C8D.tmp 125 PID 4652 wrote to memory of 4388 4652 5D59.tmp 126 PID 4388 wrote to memory of 5624 4388 5E24.tmp 127 PID 5624 wrote to memory of 3408 5624 5F0E.tmp 128 PID 3408 wrote to memory of 5784 3408 5F7B.tmp 129 PID 5784 wrote to memory of 2204 5784 6095.tmp 130 PID 2204 wrote to memory of 3164 2204 616F.tmp 131 PID 3164 wrote to memory of 1112 3164 61FC.tmp 132 PID 1112 wrote to memory of 476 1112 62B8.tmp 133 PID 476 wrote to memory of 2568 476 6383.tmp 134 PID 2568 wrote to memory of 1196 2568 641F.tmp 135 PID 1196 wrote to memory of 1312 1196 64AC.tmp 136 PID 1312 wrote to memory of 984 1312 6548.tmp 137 PID 984 wrote to memory of 2508 984 65C5.tmp 138 PID 2508 wrote to memory of 5268 2508 6642.tmp 139 PID 5268 wrote to memory of 960 5268 66EE.tmp 140 PID 960 wrote to memory of 1856 960 677A.tmp 141 PID 1856 wrote to memory of 3740 1856 67F7.tmp 142 PID 3740 wrote to memory of 1472 3740 6884.tmp 143 PID 1472 wrote to memory of 4904 1472 6901.tmp 144 PID 4904 wrote to memory of 5320 4904 698E.tmp 145 PID 5320 wrote to memory of 5812 5320 6A0B.tmp 146 PID 5812 wrote to memory of 1148 5812 6A88.tmp 147 PID 1148 wrote to memory of 5660 1148 6B14.tmp 148 PID 5660 wrote to memory of 3092 5660 6B82.tmp 149 PID 3092 wrote to memory of 2136 3092 6C0E.tmp 150 PID 2136 wrote to memory of 2092 2136 6C8B.tmp 151 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_48b0a22443787d5e2ed6546998466ffd_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_48b0a22443787d5e2ed6546998466ffd_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\39A4.tmp"C:\Users\Admin\AppData\Local\Temp\39A4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\3C53.tmp"C:\Users\Admin\AppData\Local\Temp\3C53.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\428D.tmp"C:\Users\Admin\AppData\Local\Temp\428D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\4368.tmp"C:\Users\Admin\AppData\Local\Temp\4368.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\4491.tmp"C:\Users\Admin\AppData\Local\Temp\4491.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\457B.tmp"C:\Users\Admin\AppData\Local\Temp\457B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\46C3.tmp"C:\Users\Admin\AppData\Local\Temp\46C3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\47AE.tmp"C:\Users\Admin\AppData\Local\Temp\47AE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\4954.tmp"C:\Users\Admin\AppData\Local\Temp\4954.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\4C9F.tmp"C:\Users\Admin\AppData\Local\Temp\4C9F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4E45.tmp"C:\Users\Admin\AppData\Local\Temp\4E45.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4F30.tmp"C:\Users\Admin\AppData\Local\Temp\4F30.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\501A.tmp"C:\Users\Admin\AppData\Local\Temp\501A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\5152.tmp"C:\Users\Admin\AppData\Local\Temp\5152.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\522D.tmp"C:\Users\Admin\AppData\Local\Temp\522D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\5308.tmp"C:\Users\Admin\AppData\Local\Temp\5308.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\5412.tmp"C:\Users\Admin\AppData\Local\Temp\5412.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\54CD.tmp"C:\Users\Admin\AppData\Local\Temp\54CD.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\55B7.tmp"C:\Users\Admin\AppData\Local\Temp\55B7.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\5700.tmp"C:\Users\Admin\AppData\Local\Temp\5700.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\57FA.tmp"C:\Users\Admin\AppData\Local\Temp\57FA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\5922.tmp"C:\Users\Admin\AppData\Local\Temp\5922.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\5A4B.tmp"C:\Users\Admin\AppData\Local\Temp\5A4B.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\5B65.tmp"C:\Users\Admin\AppData\Local\Temp\5B65.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\5C8D.tmp"C:\Users\Admin\AppData\Local\Temp\5C8D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5D59.tmp"C:\Users\Admin\AppData\Local\Temp\5D59.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\5F0E.tmp"C:\Users\Admin\AppData\Local\Temp\5F0E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\6095.tmp"C:\Users\Admin\AppData\Local\Temp\6095.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\616F.tmp"C:\Users\Admin\AppData\Local\Temp\616F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\61FC.tmp"C:\Users\Admin\AppData\Local\Temp\61FC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\62B8.tmp"C:\Users\Admin\AppData\Local\Temp\62B8.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\641F.tmp"C:\Users\Admin\AppData\Local\Temp\641F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\64AC.tmp"C:\Users\Admin\AppData\Local\Temp\64AC.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\66EE.tmp"C:\Users\Admin\AppData\Local\Temp\66EE.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\6884.tmp"C:\Users\Admin\AppData\Local\Temp\6884.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\6901.tmp"C:\Users\Admin\AppData\Local\Temp\6901.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\698E.tmp"C:\Users\Admin\AppData\Local\Temp\698E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\6B82.tmp"C:\Users\Admin\AppData\Local\Temp\6B82.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"65⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\6D66.tmp"C:\Users\Admin\AppData\Local\Temp\6D66.tmp"66⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\6DD3.tmp"C:\Users\Admin\AppData\Local\Temp\6DD3.tmp"67⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\6E50.tmp"C:\Users\Admin\AppData\Local\Temp\6E50.tmp"68⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"69⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"70⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"71⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\7044.tmp"C:\Users\Admin\AppData\Local\Temp\7044.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\70C1.tmp"C:\Users\Admin\AppData\Local\Temp\70C1.tmp"73⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\713E.tmp"C:\Users\Admin\AppData\Local\Temp\713E.tmp"74⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\71AC.tmp"C:\Users\Admin\AppData\Local\Temp\71AC.tmp"75⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\7229.tmp"C:\Users\Admin\AppData\Local\Temp\7229.tmp"76⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\72C5.tmp"C:\Users\Admin\AppData\Local\Temp\72C5.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:704 -
C:\Users\Admin\AppData\Local\Temp\7361.tmp"C:\Users\Admin\AppData\Local\Temp\7361.tmp"78⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\73CF.tmp"C:\Users\Admin\AppData\Local\Temp\73CF.tmp"79⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\743C.tmp"C:\Users\Admin\AppData\Local\Temp\743C.tmp"80⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\74C9.tmp"C:\Users\Admin\AppData\Local\Temp\74C9.tmp"81⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\7546.tmp"C:\Users\Admin\AppData\Local\Temp\7546.tmp"82⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\75C3.tmp"C:\Users\Admin\AppData\Local\Temp\75C3.tmp"83⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\7640.tmp"C:\Users\Admin\AppData\Local\Temp\7640.tmp"84⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\76AD.tmp"C:\Users\Admin\AppData\Local\Temp\76AD.tmp"85⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\773A.tmp"C:\Users\Admin\AppData\Local\Temp\773A.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\77B7.tmp"C:\Users\Admin\AppData\Local\Temp\77B7.tmp"87⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\7843.tmp"C:\Users\Admin\AppData\Local\Temp\7843.tmp"88⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\78C0.tmp"C:\Users\Admin\AppData\Local\Temp\78C0.tmp"89⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\794D.tmp"C:\Users\Admin\AppData\Local\Temp\794D.tmp"90⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\79CA.tmp"C:\Users\Admin\AppData\Local\Temp\79CA.tmp"91⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\7A47.tmp"C:\Users\Admin\AppData\Local\Temp\7A47.tmp"92⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\7B31.tmp"C:\Users\Admin\AppData\Local\Temp\7B31.tmp"94⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"95⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\7C1C.tmp"C:\Users\Admin\AppData\Local\Temp\7C1C.tmp"96⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"97⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\7D54.tmp"C:\Users\Admin\AppData\Local\Temp\7D54.tmp"98⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"99⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"100⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"101⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"102⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\8013.tmp"C:\Users\Admin\AppData\Local\Temp\8013.tmp"103⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\80A0.tmp"C:\Users\Admin\AppData\Local\Temp\80A0.tmp"104⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\814C.tmp"C:\Users\Admin\AppData\Local\Temp\814C.tmp"105⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\81C9.tmp"C:\Users\Admin\AppData\Local\Temp\81C9.tmp"106⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\8255.tmp"C:\Users\Admin\AppData\Local\Temp\8255.tmp"107⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\82F2.tmp"C:\Users\Admin\AppData\Local\Temp\82F2.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\837E.tmp"C:\Users\Admin\AppData\Local\Temp\837E.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\841A.tmp"C:\Users\Admin\AppData\Local\Temp\841A.tmp"110⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\84A7.tmp"C:\Users\Admin\AppData\Local\Temp\84A7.tmp"111⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"112⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\85C0.tmp"C:\Users\Admin\AppData\Local\Temp\85C0.tmp"113⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\865D.tmp"C:\Users\Admin\AppData\Local\Temp\865D.tmp"114⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\86CA.tmp"C:\Users\Admin\AppData\Local\Temp\86CA.tmp"115⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\8766.tmp"C:\Users\Admin\AppData\Local\Temp\8766.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\87E3.tmp"C:\Users\Admin\AppData\Local\Temp\87E3.tmp"117⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\8860.tmp"C:\Users\Admin\AppData\Local\Temp\8860.tmp"118⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"119⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\895A.tmp"C:\Users\Admin\AppData\Local\Temp\895A.tmp"120⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"121⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\8A83.tmp"C:\Users\Admin\AppData\Local\Temp\8A83.tmp"122⤵PID:4676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-