Analysis
- max time kernel
76s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 04:20
Static task
static1
Behavioral task
behavioral1
Sample
2026-06-27_a4f1ba70470e19f8896547cee5c91ea7_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-06-27_a4f1ba70470e19f8896547cee5c91ea7_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260617-en
General
- Target 2026-06-27_a4f1ba70470e19f8896547cee5c91ea7_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260629-eykhdad19m
- SHA256 4b3239a4387a10a6fdf9957bc1a8e4c62b4e30e5fce84bd9ed9ac0daf0143361
- MD5 a4f1ba70470e19f8896547cee5c91ea7
- SHA1 740ad990bf9d85f0794420b973f4a141c7a0a65c
- SHA512 dd58d17c046fd2af3b698728aeab9e9a17d11faaa6b26cb9a727e5084bb5e0114773b44453caa72b35a21659c71734efd1b5713e949a4b6156bb962e55ec27b3
- SSDEEP 12288:wU5rCOTeiDrntquBa0Dv0qowkLNNZ+3/v+I9hUG2VA:wUQOJDrch0xowkBNGEA
- TLSH T1E9E4D02173D8C136E5FB037859B5E6614E7EBD226722D6DF6F8011AE0AB1BC09631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 2904 E625.tmp 4636 E6A2.tmp 4092 E829.tmp 1288 E951.tmp 904 EA2C.tmp 2016 EAA9.tmp 3556 EBB3.tmp 2592 ECCC.tmp 5404 EDD6.tmp 5452 EEDF.tmp 3044 EF4D.tmp 5664 F095.tmp 1700 F1AE.tmp 3596 F2C7.tmp 3620 F3C1.tmp 5268 F4EA.tmp 916 F5D5.tmp 3324 F6CF.tmp 2228 F7E8.tmp 2568 F940.tmp 1036 FA49.tmp 5352 FB82.tmp 2316 FCD9.tmp 5408 FDB4.tmp 108 FEAE.tmp 2520 FFC7.tmp 4444 C1.tmp 572 19C.tmp 5216 277.tmp 2632 361.tmp 4744 43C.tmp 2840 526.tmp 4768 601.tmp 4320 68E.tmp 4304 73A.tmp 2740 7F5.tmp 5372 8B1.tmp 1176 98B.tmp 1672 A47.tmp 2980 B12.tmp 3456 BED.tmp 2336 CA8.tmp 2892 D93.tmp 2692 E2F.tmp 3680 ECB.tmp 1228 FA6.tmp 5200 1052.tmp 1468 10FE.tmp 5968 119A.tmp 4800 1236.tmp 2672 12B3.tmp 1316 1330.tmp 3132 13BD.tmp 5768 1449.tmp 6104 14C6.tmp 5084 1534.tmp 5472 15A1.tmp 5048 162E.tmp 2620 16AB.tmp 2488 1718.tmp 4468 1795.tmp 1008 1812.tmp 2756 189F.tmp 4984 191C.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 210B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C47F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E44B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 400D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 981F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2820.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6018.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A86B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6529.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 768E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9159.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F10D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 265A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F497.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E536.tmp - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{4C6272F1-3ED3-4BD9-84E2-6C0790D6288D} explorer.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{2F0B899D-3C06-4D78-9F4A-42200BEE1CF7} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1792 explorer.exe 1792 explorer.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe Token: SeShutdownPrivilege 1792 explorer.exe Token: SeCreatePagefilePrivilege 1792 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 1184 sihost.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe 1792 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4728 StartMenuExperienceHost.exe 5820 SearchHost.exe 1792 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1384 wrote to memory of 2904 1384 2026-06-27_a4f1ba70470e19f8896547cee5c91ea7_elex_mafia_stealc_tofsee.exe 89 PID 2904 wrote to memory of 4636 2904 E625.tmp 90 PID 4636 wrote to memory of 4092 4636 E6A2.tmp 91 PID 4092 wrote to memory of 1288 4092 E829.tmp 92 PID 1288 wrote to memory of 904 1288 E951.tmp 93 PID 904 wrote to memory of 2016 904 EA2C.tmp 94 PID 2016 wrote to memory of 3556 2016 EAA9.tmp 95 PID 3556 wrote to memory of 2592 3556 EBB3.tmp 96 PID 2592 wrote to memory of 5404 2592 ECCC.tmp 97 PID 5404 wrote to memory of 5452 5404 EDD6.tmp 98 PID 5452 wrote to memory of 3044 5452 EEDF.tmp 99 PID 3044 wrote to memory of 5664 3044 EF4D.tmp 100 PID 5664 wrote to memory of 1700 5664 F095.tmp 101 PID 1700 wrote to memory of 3596 1700 F1AE.tmp 102 PID 3596 wrote to memory of 3620 3596 F2C7.tmp 103 PID 3620 wrote to memory of 5268 3620 F3C1.tmp 104 PID 5268 wrote to memory of 916 5268 F4EA.tmp 105 PID 916 wrote to memory of 3324 916 F5D5.tmp 106 PID 3324 wrote to memory of 2228 3324 F6CF.tmp 107 PID 2228 wrote to memory of 2568 2228 F7E8.tmp 108 PID 2568 wrote to memory of 1036 2568 F940.tmp 109 PID 1036 wrote to memory of 5352 1036 FA49.tmp 110 PID 5352 wrote to memory of 2316 5352 FB82.tmp 111 PID 2316 wrote to memory of 5408 2316 FCD9.tmp 112 PID 5408 wrote to memory of 108 5408 FDB4.tmp 113 PID 108 wrote to memory of 2520 108 FEAE.tmp 114 PID 2520 wrote to memory of 4444 2520 FFC7.tmp 115 PID 4444 wrote to memory of 572 4444 C1.tmp 116 PID 572 wrote to memory of 5216 572 19C.tmp 117 PID 5216 wrote to memory of 2632 5216 277.tmp 118 PID 2632 wrote to memory of 4744 2632 361.tmp 119 PID 4744 wrote to memory of 2840 4744 43C.tmp 120 PID 2840 wrote to memory of 4768 2840 526.tmp 121 PID 4768 wrote to memory of 4320 4768 601.tmp 122 PID 4320 wrote to memory of 4304 4320 68E.tmp 123 PID 4304 wrote to memory of 2740 4304 73A.tmp 124 PID 2740 wrote to memory of 5372 2740 7F5.tmp 125 PID 5372 wrote to memory of 1176 5372 8B1.tmp 126 PID 1176 wrote to memory of 1672 1176 98B.tmp 127 PID 1672 wrote to memory of 2980 1672 A47.tmp 128 PID 2980 wrote to memory of 3456 2980 B12.tmp 129 PID 3456 wrote to memory of 2336 3456 BED.tmp 130 PID 2336 wrote to memory of 2892 2336 CA8.tmp 131 PID 2892 wrote to memory of 2692 2892 D93.tmp 132 PID 2692 wrote to memory of 3680 2692 E2F.tmp 133 PID 3680 wrote to memory of 1228 3680 ECB.tmp 134 PID 1228 wrote to memory of 5200 1228 FA6.tmp 135 PID 5200 wrote to memory of 1468 5200 1052.tmp 136 PID 1468 wrote to memory of 5968 1468 10FE.tmp 137 PID 5968 wrote to memory of 4800 5968 119A.tmp 138 PID 4800 wrote to memory of 2672 4800 1236.tmp 139 PID 2672 wrote to memory of 1316 2672 12B3.tmp 140 PID 1316 wrote to memory of 3132 1316 1330.tmp 141 PID 3132 wrote to memory of 5768 3132 13BD.tmp 142 PID 5768 wrote to memory of 6104 5768 1449.tmp 143 PID 6104 wrote to memory of 5084 6104 14C6.tmp 144 PID 5084 wrote to memory of 5472 5084 1534.tmp 145 PID 5472 wrote to memory of 5048 5472 15A1.tmp 146 PID 5048 wrote to memory of 2620 5048 162E.tmp 147 PID 2620 wrote to memory of 2488 2620 16AB.tmp 148 PID 2488 wrote to memory of 4468 2488 1718.tmp 149 PID 4468 wrote to memory of 1008 4468 1795.tmp 150 PID 1008 wrote to memory of 2756 1008 1812.tmp 151 PID 2756 wrote to memory of 4984 2756 189F.tmp 152 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_a4f1ba70470e19f8896547cee5c91ea7_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a4f1ba70470e19f8896547cee5c91ea7_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\E625.tmp"C:\Users\Admin\AppData\Local\Temp\E625.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\E829.tmp"C:\Users\Admin\AppData\Local\Temp\E829.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\E951.tmp"C:\Users\Admin\AppData\Local\Temp\E951.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\ECCC.tmp"C:\Users\Admin\AppData\Local\Temp\ECCC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\EEDF.tmp"C:\Users\Admin\AppData\Local\Temp\EEDF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\EF4D.tmp"C:\Users\Admin\AppData\Local\Temp\EF4D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\F095.tmp"C:\Users\Admin\AppData\Local\Temp\F095.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\F1AE.tmp"C:\Users\Admin\AppData\Local\Temp\F1AE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\F6CF.tmp"C:\Users\Admin\AppData\Local\Temp\F6CF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\F940.tmp"C:\Users\Admin\AppData\Local\Temp\F940.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\FA49.tmp"C:\Users\Admin\AppData\Local\Temp\FA49.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\FB82.tmp"C:\Users\Admin\AppData\Local\Temp\FB82.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\FCD9.tmp"C:\Users\Admin\AppData\Local\Temp\FCD9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\FEAE.tmp"C:\Users\Admin\AppData\Local\Temp\FEAE.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\FFC7.tmp"C:\Users\Admin\AppData\Local\Temp\FFC7.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\C1.tmp"C:\Users\Admin\AppData\Local\Temp\C1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\19C.tmp"C:\Users\Admin\AppData\Local\Temp\19C.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\277.tmp"C:\Users\Admin\AppData\Local\Temp\277.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\361.tmp"C:\Users\Admin\AppData\Local\Temp\361.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\43C.tmp"C:\Users\Admin\AppData\Local\Temp\43C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\526.tmp"C:\Users\Admin\AppData\Local\Temp\526.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\601.tmp"C:\Users\Admin\AppData\Local\Temp\601.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\68E.tmp"C:\Users\Admin\AppData\Local\Temp\68E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\73A.tmp"C:\Users\Admin\AppData\Local\Temp\73A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\7F5.tmp"C:\Users\Admin\AppData\Local\Temp\7F5.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\8B1.tmp"C:\Users\Admin\AppData\Local\Temp\8B1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\98B.tmp"C:\Users\Admin\AppData\Local\Temp\98B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\A47.tmp"C:\Users\Admin\AppData\Local\Temp\A47.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\B12.tmp"C:\Users\Admin\AppData\Local\Temp\B12.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\BED.tmp"C:\Users\Admin\AppData\Local\Temp\BED.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\CA8.tmp"C:\Users\Admin\AppData\Local\Temp\CA8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\D93.tmp"C:\Users\Admin\AppData\Local\Temp\D93.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\E2F.tmp"C:\Users\Admin\AppData\Local\Temp\E2F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\ECB.tmp"C:\Users\Admin\AppData\Local\Temp\ECB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\FA6.tmp"C:\Users\Admin\AppData\Local\Temp\FA6.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\1052.tmp"C:\Users\Admin\AppData\Local\Temp\1052.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\10FE.tmp"C:\Users\Admin\AppData\Local\Temp\10FE.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\119A.tmp"C:\Users\Admin\AppData\Local\Temp\119A.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\1236.tmp"C:\Users\Admin\AppData\Local\Temp\1236.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\12B3.tmp"C:\Users\Admin\AppData\Local\Temp\12B3.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\1330.tmp"C:\Users\Admin\AppData\Local\Temp\1330.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\13BD.tmp"C:\Users\Admin\AppData\Local\Temp\13BD.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\14C6.tmp"C:\Users\Admin\AppData\Local\Temp\14C6.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\1534.tmp"C:\Users\Admin\AppData\Local\Temp\1534.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\162E.tmp"C:\Users\Admin\AppData\Local\Temp\162E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\16AB.tmp"C:\Users\Admin\AppData\Local\Temp\16AB.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1718.tmp"C:\Users\Admin\AppData\Local\Temp\1718.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\1795.tmp"C:\Users\Admin\AppData\Local\Temp\1795.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\1812.tmp"C:\Users\Admin\AppData\Local\Temp\1812.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"65⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"66⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"67⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"68⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"69⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"70⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\1C48.tmp"C:\Users\Admin\AppData\Local\Temp\1C48.tmp"71⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\1CD5.tmp"C:\Users\Admin\AppData\Local\Temp\1CD5.tmp"72⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\1D52.tmp"C:\Users\Admin\AppData\Local\Temp\1D52.tmp"73⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"74⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"75⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\1F07.tmp"C:\Users\Admin\AppData\Local\Temp\1F07.tmp"76⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\1F94.tmp"C:\Users\Admin\AppData\Local\Temp\1F94.tmp"77⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\2011.tmp"C:\Users\Admin\AppData\Local\Temp\2011.tmp"78⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\209E.tmp"C:\Users\Admin\AppData\Local\Temp\209E.tmp"79⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\210B.tmp"C:\Users\Admin\AppData\Local\Temp\210B.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\21B7.tmp"C:\Users\Admin\AppData\Local\Temp\21B7.tmp"81⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\2244.tmp"C:\Users\Admin\AppData\Local\Temp\2244.tmp"82⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\22B1.tmp"C:\Users\Admin\AppData\Local\Temp\22B1.tmp"83⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\232E.tmp"C:\Users\Admin\AppData\Local\Temp\232E.tmp"84⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\23AB.tmp"C:\Users\Admin\AppData\Local\Temp\23AB.tmp"85⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\2438.tmp"C:\Users\Admin\AppData\Local\Temp\2438.tmp"86⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\24B5.tmp"C:\Users\Admin\AppData\Local\Temp\24B5.tmp"87⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2541.tmp"C:\Users\Admin\AppData\Local\Temp\2541.tmp"88⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\25DD.tmp"C:\Users\Admin\AppData\Local\Temp\25DD.tmp"89⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\265A.tmp"C:\Users\Admin\AppData\Local\Temp\265A.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\26D7.tmp"C:\Users\Admin\AppData\Local\Temp\26D7.tmp"91⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2745.tmp"C:\Users\Admin\AppData\Local\Temp\2745.tmp"92⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\27B2.tmp"C:\Users\Admin\AppData\Local\Temp\27B2.tmp"93⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\28AC.tmp"C:\Users\Admin\AppData\Local\Temp\28AC.tmp"95⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\2939.tmp"C:\Users\Admin\AppData\Local\Temp\2939.tmp"96⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\29A6.tmp"C:\Users\Admin\AppData\Local\Temp\29A6.tmp"97⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\2A23.tmp"C:\Users\Admin\AppData\Local\Temp\2A23.tmp"98⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"99⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\2B2D.tmp"C:\Users\Admin\AppData\Local\Temp\2B2D.tmp"100⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\2BB9.tmp"C:\Users\Admin\AppData\Local\Temp\2BB9.tmp"101⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\2C56.tmp"C:\Users\Admin\AppData\Local\Temp\2C56.tmp"102⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\2D50.tmp"C:\Users\Admin\AppData\Local\Temp\2D50.tmp"104⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2DDC.tmp"C:\Users\Admin\AppData\Local\Temp\2DDC.tmp"105⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2E79.tmp"C:\Users\Admin\AppData\Local\Temp\2E79.tmp"106⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\2F15.tmp"C:\Users\Admin\AppData\Local\Temp\2F15.tmp"107⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\2F92.tmp"C:\Users\Admin\AppData\Local\Temp\2F92.tmp"108⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\302E.tmp"C:\Users\Admin\AppData\Local\Temp\302E.tmp"109⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\309B.tmp"C:\Users\Admin\AppData\Local\Temp\309B.tmp"110⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\3128.tmp"C:\Users\Admin\AppData\Local\Temp\3128.tmp"111⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\31A5.tmp"C:\Users\Admin\AppData\Local\Temp\31A5.tmp"112⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\3232.tmp"C:\Users\Admin\AppData\Local\Temp\3232.tmp"113⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\32BE.tmp"C:\Users\Admin\AppData\Local\Temp\32BE.tmp"114⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\334B.tmp"C:\Users\Admin\AppData\Local\Temp\334B.tmp"115⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\33D8.tmp"C:\Users\Admin\AppData\Local\Temp\33D8.tmp"116⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\3455.tmp"C:\Users\Admin\AppData\Local\Temp\3455.tmp"117⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\34D2.tmp"C:\Users\Admin\AppData\Local\Temp\34D2.tmp"118⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\354F.tmp"C:\Users\Admin\AppData\Local\Temp\354F.tmp"119⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\35BC.tmp"C:\Users\Admin\AppData\Local\Temp\35BC.tmp"120⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3639.tmp"C:\Users\Admin\AppData\Local\Temp\3639.tmp"121⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\36D5.tmp"C:\Users\Admin\AppData\Local\Temp\36D5.tmp"122⤵PID:1580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-