Analysis
- max time kernel
80s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 07:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_60c501e235a61dbd3d043a761d3efa17_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_60c501e235a61dbd3d043a761d3efa17_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
13 signatures
150 seconds
General
- Target 2026-07-02_60c501e235a61dbd3d043a761d3efa17_elex_mafia_poet-rat_stealc_tofsee.exe
- Size 1.8MB
- Sample260702-jktlcacv2p
- SHA256 52cc0c7f4b7f09f4e41a5b4c231f46356e3047cfce6724d84a2d8c2838e9835c
- MD5 60c501e235a61dbd3d043a761d3efa17
- SHA1 324af304713b8c182245716a5e616f8b20d5cfce
- SHA512 e1f76e819af2cc2fc963bb983fc6be137109e96cd46d8479f02516e17cc37e2e8891662fb7de7e6a35db78be165f79e97f60cf5f422b4fb67ffbfe9959421c3e
- SSDEEP 24576:wUQOJDhagp5Yv4BuPNGEAFC5etW0Ri+aMyFH1KN:w/OJDIKYv5NGEADt7i+/yTW
- TLSH T11795912277FD0608F2F75E752AB6F9504C7ABDA25D21D29D1078908E8D71B80DA63B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 6108 A739.tmp 2796 A9C9.tmp 4680 AC3A.tmp 1664 AD05.tmp 3124 AF38.tmp 3828 AFF3.tmp 5152 B3CB.tmp 4124 B5FE.tmp 4440 B821.tmp 3672 BA63.tmp 5208 BC57.tmp 3428 BEA9.tmp 4916 C0EB.tmp 4944 C2B0.tmp 5844 C494.tmp 2268 C688.tmp 1196 C89C.tmp 3568 CA70.tmp 3184 CC55.tmp 1188 CE1A.tmp 6136 CFFE.tmp 5784 D137.tmp 1900 D379.tmp 2452 D55D.tmp 1588 D770.tmp 480 D984.tmp 1028 DB78.tmp 5952 DD6C.tmp 2496 DF7F.tmp 3424 E23E.tmp 2332 E386.tmp 1572 E599.tmp 3744 E7DC.tmp 5000 E8B6.tmp 3700 E9A1.tmp 5236 EAD9.tmp 3092 EBA4.tmp 3924 EC7F.tmp 2776 ED89.tmp 1272 EEC1.tmp 600 EF9C.tmp 5316 F086.tmp 5576 F1EE.tmp 5024 F2F7.tmp 1860 F48E.tmp 1852 F5C6.tmp 2612 F6D0.tmp 5888 F837.tmp 3716 F8E3.tmp 3176 F9AE.tmp 3268 FA98.tmp 2136 FB92.tmp 2408 FC3E.tmp 1304 FCFA.tmp 3432 FD96.tmp 4764 FE90.tmp 3004 FF3C.tmp 1732 C3.tmp 2436 18E.tmp 5932 268.tmp 5036 334.tmp 1348 3DF.tmp 3168 4AB.tmp 4500 576.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 455D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E386.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E599.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8208.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C328.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 652A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3158.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B51E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D151.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D681.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6808.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 969A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5878.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7324.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 816C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9801.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6410.tmp - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{C662DCE5-DAA3-4000-B139-52456048E7B5} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{DF2AF2A5-89BC-45F6-AC1C-83E758D5D90B} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3500 explorer.exe 3500 explorer.exe - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe Token: SeShutdownPrivilege 3500 explorer.exe Token: SeCreatePagefilePrivilege 3500 explorer.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 4620 sihost.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe 3500 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1184 StartMenuExperienceHost.exe 5160 SearchHost.exe 3500 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1124 wrote to memory of 6108 1124 2026-07-02_60c501e235a61dbd3d043a761d3efa17_elex_mafia_poet-rat_stealc_tofsee.exe 89 PID 6108 wrote to memory of 2796 6108 A739.tmp 90 PID 2796 wrote to memory of 4680 2796 A9C9.tmp 91 PID 4680 wrote to memory of 1664 4680 AC3A.tmp 92 PID 1664 wrote to memory of 3124 1664 AD05.tmp 93 PID 3124 wrote to memory of 3828 3124 AF38.tmp 94 PID 3828 wrote to memory of 5152 3828 AFF3.tmp 95 PID 5152 wrote to memory of 4124 5152 B3CB.tmp 96 PID 4124 wrote to memory of 4440 4124 B5FE.tmp 97 PID 4440 wrote to memory of 3672 4440 B821.tmp 98 PID 3672 wrote to memory of 5208 3672 BA63.tmp 99 PID 5208 wrote to memory of 3428 5208 BC57.tmp 100 PID 3428 wrote to memory of 4916 3428 BEA9.tmp 101 PID 4916 wrote to memory of 4944 4916 C0EB.tmp 102 PID 4944 wrote to memory of 5844 4944 C2B0.tmp 103 PID 5844 wrote to memory of 2268 5844 C494.tmp 104 PID 2268 wrote to memory of 1196 2268 C688.tmp 105 PID 1196 wrote to memory of 3568 1196 C89C.tmp 106 PID 3568 wrote to memory of 3184 3568 CA70.tmp 107 PID 3184 wrote to memory of 1188 3184 CC55.tmp 108 PID 1188 wrote to memory of 6136 1188 CE1A.tmp 109 PID 6136 wrote to memory of 5784 6136 CFFE.tmp 110 PID 5784 wrote to memory of 1900 5784 D137.tmp 111 PID 1900 wrote to memory of 2452 1900 D379.tmp 112 PID 2452 wrote to memory of 1588 2452 D55D.tmp 113 PID 1588 wrote to memory of 480 1588 D770.tmp 114 PID 480 wrote to memory of 1028 480 D984.tmp 115 PID 1028 wrote to memory of 5952 1028 DB78.tmp 116 PID 5952 wrote to memory of 2496 5952 DD6C.tmp 117 PID 2496 wrote to memory of 3424 2496 DF7F.tmp 118 PID 3424 wrote to memory of 2332 3424 E23E.tmp 119 PID 2332 wrote to memory of 1572 2332 E386.tmp 120 PID 1572 wrote to memory of 3744 1572 E599.tmp 121 PID 3744 wrote to memory of 5000 3744 E7DC.tmp 122 PID 5000 wrote to memory of 3700 5000 E8B6.tmp 123 PID 3700 wrote to memory of 5236 3700 E9A1.tmp 124 PID 5236 wrote to memory of 3092 5236 EAD9.tmp 125 PID 3092 wrote to memory of 3924 3092 EBA4.tmp 126 PID 3924 wrote to memory of 2776 3924 EC7F.tmp 127 PID 2776 wrote to memory of 1272 2776 ED89.tmp 128 PID 1272 wrote to memory of 600 1272 EEC1.tmp 129 PID 600 wrote to memory of 5316 600 EF9C.tmp 130 PID 5316 wrote to memory of 5576 5316 F086.tmp 131 PID 5576 wrote to memory of 5024 5576 F1EE.tmp 132 PID 5024 wrote to memory of 1860 5024 F2F7.tmp 133 PID 1860 wrote to memory of 1852 1860 F48E.tmp 134 PID 1852 wrote to memory of 2612 1852 F5C6.tmp 135 PID 2612 wrote to memory of 5888 2612 F6D0.tmp 136 PID 5888 wrote to memory of 3716 5888 F837.tmp 137 PID 3716 wrote to memory of 3176 3716 F8E3.tmp 138 PID 3176 wrote to memory of 3268 3176 F9AE.tmp 139 PID 3268 wrote to memory of 2136 3268 FA98.tmp 140 PID 2136 wrote to memory of 2408 2136 FB92.tmp 141 PID 2408 wrote to memory of 1304 2408 FC3E.tmp 142 PID 1304 wrote to memory of 3432 1304 FCFA.tmp 143 PID 3432 wrote to memory of 4764 3432 FD96.tmp 144 PID 4764 wrote to memory of 3004 4764 FE90.tmp 145 PID 4756 wrote to memory of 1732 4756 7.tmp 147 PID 1732 wrote to memory of 2436 1732 C3.tmp 148 PID 2436 wrote to memory of 5932 2436 18E.tmp 149 PID 5932 wrote to memory of 5036 5932 268.tmp 150 PID 5036 wrote to memory of 1348 5036 334.tmp 151 PID 1348 wrote to memory of 3168 1348 3DF.tmp 152 PID 3168 wrote to memory of 4500 3168 4AB.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_60c501e235a61dbd3d043a761d3efa17_elex_mafia_poet-rat_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_60c501e235a61dbd3d043a761d3efa17_elex_mafia_poet-rat_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\A739.tmp"C:\Users\Admin\AppData\Local\Temp\A739.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\A9C9.tmp"C:\Users\Admin\AppData\Local\Temp\A9C9.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\AC3A.tmp"C:\Users\Admin\AppData\Local\Temp\AC3A.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\AD05.tmp"C:\Users\Admin\AppData\Local\Temp\AD05.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\AF38.tmp"C:\Users\Admin\AppData\Local\Temp\AF38.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\AFF3.tmp"C:\Users\Admin\AppData\Local\Temp\AFF3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\B3CB.tmp"C:\Users\Admin\AppData\Local\Temp\B3CB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\B5FE.tmp"C:\Users\Admin\AppData\Local\Temp\B5FE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\B821.tmp"C:\Users\Admin\AppData\Local\Temp\B821.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\BA63.tmp"C:\Users\Admin\AppData\Local\Temp\BA63.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\BC57.tmp"C:\Users\Admin\AppData\Local\Temp\BC57.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\BEA9.tmp"C:\Users\Admin\AppData\Local\Temp\BEA9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\C0EB.tmp"C:\Users\Admin\AppData\Local\Temp\C0EB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\C2B0.tmp"C:\Users\Admin\AppData\Local\Temp\C2B0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\C494.tmp"C:\Users\Admin\AppData\Local\Temp\C494.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\C688.tmp"C:\Users\Admin\AppData\Local\Temp\C688.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\C89C.tmp"C:\Users\Admin\AppData\Local\Temp\C89C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\CC55.tmp"C:\Users\Admin\AppData\Local\Temp\CC55.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\CE1A.tmp"C:\Users\Admin\AppData\Local\Temp\CE1A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\CFFE.tmp"C:\Users\Admin\AppData\Local\Temp\CFFE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\D137.tmp"C:\Users\Admin\AppData\Local\Temp\D137.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\D379.tmp"C:\Users\Admin\AppData\Local\Temp\D379.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\D55D.tmp"C:\Users\Admin\AppData\Local\Temp\D55D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\D770.tmp"C:\Users\Admin\AppData\Local\Temp\D770.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\D984.tmp"C:\Users\Admin\AppData\Local\Temp\D984.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\DB78.tmp"C:\Users\Admin\AppData\Local\Temp\DB78.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\DD6C.tmp"C:\Users\Admin\AppData\Local\Temp\DD6C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\DF7F.tmp"C:\Users\Admin\AppData\Local\Temp\DF7F.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\E23E.tmp"C:\Users\Admin\AppData\Local\Temp\E23E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\E386.tmp"C:\Users\Admin\AppData\Local\Temp\E386.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\E599.tmp"C:\Users\Admin\AppData\Local\Temp\E599.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\E7DC.tmp"C:\Users\Admin\AppData\Local\Temp\E7DC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\E8B6.tmp"C:\Users\Admin\AppData\Local\Temp\E8B6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\E9A1.tmp"C:\Users\Admin\AppData\Local\Temp\E9A1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\EAD9.tmp"C:\Users\Admin\AppData\Local\Temp\EAD9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\EBA4.tmp"C:\Users\Admin\AppData\Local\Temp\EBA4.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\EC7F.tmp"C:\Users\Admin\AppData\Local\Temp\EC7F.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\ED89.tmp"C:\Users\Admin\AppData\Local\Temp\ED89.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\EEC1.tmp"C:\Users\Admin\AppData\Local\Temp\EEC1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\F086.tmp"C:\Users\Admin\AppData\Local\Temp\F086.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\F1EE.tmp"C:\Users\Admin\AppData\Local\Temp\F1EE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\F2F7.tmp"C:\Users\Admin\AppData\Local\Temp\F2F7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\F48E.tmp"C:\Users\Admin\AppData\Local\Temp\F48E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\F5C6.tmp"C:\Users\Admin\AppData\Local\Temp\F5C6.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\F6D0.tmp"C:\Users\Admin\AppData\Local\Temp\F6D0.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\F837.tmp"C:\Users\Admin\AppData\Local\Temp\F837.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\F8E3.tmp"C:\Users\Admin\AppData\Local\Temp\F8E3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\F9AE.tmp"C:\Users\Admin\AppData\Local\Temp\F9AE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\FA98.tmp"C:\Users\Admin\AppData\Local\Temp\FA98.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\FB92.tmp"C:\Users\Admin\AppData\Local\Temp\FB92.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\FC3E.tmp"C:\Users\Admin\AppData\Local\Temp\FC3E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\FCFA.tmp"C:\Users\Admin\AppData\Local\Temp\FCFA.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\FD96.tmp"C:\Users\Admin\AppData\Local\Temp\FD96.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\FE90.tmp"C:\Users\Admin\AppData\Local\Temp\FE90.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\FF3C.tmp"C:\Users\Admin\AppData\Local\Temp\FF3C.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\7.tmp"C:\Users\Admin\AppData\Local\Temp\7.tmp"59⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\C3.tmp"C:\Users\Admin\AppData\Local\Temp\C3.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\18E.tmp"C:\Users\Admin\AppData\Local\Temp\18E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\268.tmp"C:\Users\Admin\AppData\Local\Temp\268.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\334.tmp"C:\Users\Admin\AppData\Local\Temp\334.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\3DF.tmp"C:\Users\Admin\AppData\Local\Temp\3DF.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\4AB.tmp"C:\Users\Admin\AppData\Local\Temp\4AB.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\576.tmp"C:\Users\Admin\AppData\Local\Temp\576.tmp"66⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\660.tmp"C:\Users\Admin\AppData\Local\Temp\660.tmp"67⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\72B.tmp"C:\Users\Admin\AppData\Local\Temp\72B.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\7F6.tmp"C:\Users\Admin\AppData\Local\Temp\7F6.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\893.tmp"C:\Users\Admin\AppData\Local\Temp\893.tmp"70⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\95E.tmp"C:\Users\Admin\AppData\Local\Temp\95E.tmp"71⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\A19.tmp"C:\Users\Admin\AppData\Local\Temp\A19.tmp"72⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\AD5.tmp"C:\Users\Admin\AppData\Local\Temp\AD5.tmp"73⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\BA0.tmp"C:\Users\Admin\AppData\Local\Temp\BA0.tmp"74⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\C6B.tmp"C:\Users\Admin\AppData\Local\Temp\C6B.tmp"75⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\D07.tmp"C:\Users\Admin\AppData\Local\Temp\D07.tmp"76⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\E01.tmp"C:\Users\Admin\AppData\Local\Temp\E01.tmp"77⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\E8E.tmp"C:\Users\Admin\AppData\Local\Temp\E8E.tmp"78⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\F49.tmp"C:\Users\Admin\AppData\Local\Temp\F49.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\1014.tmp"C:\Users\Admin\AppData\Local\Temp\1014.tmp"80⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\10D0.tmp"C:\Users\Admin\AppData\Local\Temp\10D0.tmp"81⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\117C.tmp"C:\Users\Admin\AppData\Local\Temp\117C.tmp"82⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\1237.tmp"C:\Users\Admin\AppData\Local\Temp\1237.tmp"83⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\1312.tmp"C:\Users\Admin\AppData\Local\Temp\1312.tmp"84⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\13AE.tmp"C:\Users\Admin\AppData\Local\Temp\13AE.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\143B.tmp"C:\Users\Admin\AppData\Local\Temp\143B.tmp"86⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"87⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\1583.tmp"C:\Users\Admin\AppData\Local\Temp\1583.tmp"88⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"89⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"90⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"91⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\18B0.tmp"C:\Users\Admin\AppData\Local\Temp\18B0.tmp"92⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\196B.tmp"C:\Users\Admin\AppData\Local\Temp\196B.tmp"93⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\19F8.tmp"C:\Users\Admin\AppData\Local\Temp\19F8.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\1A94.tmp"C:\Users\Admin\AppData\Local\Temp\1A94.tmp"95⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\1B40.tmp"C:\Users\Admin\AppData\Local\Temp\1B40.tmp"96⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\1BFB.tmp"C:\Users\Admin\AppData\Local\Temp\1BFB.tmp"97⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\1C98.tmp"C:\Users\Admin\AppData\Local\Temp\1C98.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\1D43.tmp"C:\Users\Admin\AppData\Local\Temp\1D43.tmp"99⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\1DFF.tmp"C:\Users\Admin\AppData\Local\Temp\1DFF.tmp"100⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\1ECA.tmp"C:\Users\Admin\AppData\Local\Temp\1ECA.tmp"101⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\1F76.tmp"C:\Users\Admin\AppData\Local\Temp\1F76.tmp"102⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\2022.tmp"C:\Users\Admin\AppData\Local\Temp\2022.tmp"103⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\20CE.tmp"C:\Users\Admin\AppData\Local\Temp\20CE.tmp"104⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\216A.tmp"C:\Users\Admin\AppData\Local\Temp\216A.tmp"105⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\2206.tmp"C:\Users\Admin\AppData\Local\Temp\2206.tmp"106⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\22B2.tmp"C:\Users\Admin\AppData\Local\Temp\22B2.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\235E.tmp"C:\Users\Admin\AppData\Local\Temp\235E.tmp"108⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\23FA.tmp"C:\Users\Admin\AppData\Local\Temp\23FA.tmp"109⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\2487.tmp"C:\Users\Admin\AppData\Local\Temp\2487.tmp"110⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\2513.tmp"C:\Users\Admin\AppData\Local\Temp\2513.tmp"111⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\25BF.tmp"C:\Users\Admin\AppData\Local\Temp\25BF.tmp"112⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\265C.tmp"C:\Users\Admin\AppData\Local\Temp\265C.tmp"113⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\26D9.tmp"C:\Users\Admin\AppData\Local\Temp\26D9.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\2794.tmp"C:\Users\Admin\AppData\Local\Temp\2794.tmp"115⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\2830.tmp"C:\Users\Admin\AppData\Local\Temp\2830.tmp"116⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\28CD.tmp"C:\Users\Admin\AppData\Local\Temp\28CD.tmp"117⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\29A7.tmp"C:\Users\Admin\AppData\Local\Temp\29A7.tmp"118⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\2A44.tmp"C:\Users\Admin\AppData\Local\Temp\2A44.tmp"119⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\2AE0.tmp"C:\Users\Admin\AppData\Local\Temp\2AE0.tmp"120⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\2B8C.tmp"C:\Users\Admin\AppData\Local\Temp\2B8C.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\2C28.tmp"C:\Users\Admin\AppData\Local\Temp\2C28.tmp"122⤵PID:3856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-