Analysis
- max time kernel
72s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_9b03522e2a6f160b9c85c8bb64fb5276_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_9b03522e2a6f160b9c85c8bb64fb5276_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
13 signatures
150 seconds
General
- Target 2026-07-03_9b03522e2a6f160b9c85c8bb64fb5276_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260703-c79shsft3q
- SHA256 cbab2a3f8d88af39593cae4b620f4cf586e3a1d1225a60086bef92f556a7dccc
- MD5 9b03522e2a6f160b9c85c8bb64fb5276
- SHA1 72f8727e8b5bbdc26617dd9812fa393f25e52c57
- SHA512 1d7cc8cfc071e6a48f04fddd915fa596d797fa01d20a367607cb0f77de947c55edd5815e2a85c404baf49706d7278d91529290616b6e57e4ded1240d1f0c97a6
- SSDEEP 12288:NU5rCOTeijZ0b9DtrTVmCkzpLXYVaTZwlH:NUQOJjZSDFT8CGLXYoTSlH
- TLSH T19AB4F1217584C232E69202710BD6EBB16A3B7D715726A4C73B84A73E2FB12E1D3B5347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 2840 A719.tmp 5852 A7C5.tmp 2560 A890.tmp 1240 A8FE.tmp 3704 A9AA.tmp 3784 AA75.tmp 4576 AB21.tmp 4900 ABDC.tmp 1548 AC59.tmp 2484 AD34.tmp 4484 AE5D.tmp 5224 AF47.tmp 5972 AFD4.tmp 1168 B08F.tmp 836 B12C.tmp 2524 B1D7.tmp 2592 B2C2.tmp 1896 B33F.tmp 5216 B429.tmp 2936 B4B6.tmp 2500 B581.tmp 5792 B60E.tmp 4384 B6AA.tmp 2880 B736.tmp 3228 B7E2.tmp 4720 B89E.tmp 5776 B988.tmp 1900 BA53.tmp 764 BAE0.tmp 1496 BB6D.tmp 5048 BC09.tmp 472 BCD4.tmp 848 BD51.tmp 1652 BDCE.tmp 2016 BE5B.tmp 2416 BEE7.tmp 3200 BF83.tmp 5684 C020.tmp 4448 C09D.tmp 2708 C129.tmp 988 C1A6.tmp 5444 C233.tmp 1828 C2C0.tmp 5960 C35C.tmp 1688 C3C9.tmp 912 C456.tmp 3180 C4C3.tmp 4648 C550.tmp 4988 C5CD.tmp 2776 C669.tmp 1512 C6E6.tmp 4000 C773.tmp 1056 C7E0.tmp 5400 C85D.tmp 4412 C8DA.tmp 2376 C976.tmp 5720 C9D4.tmp 2036 CA70.tmp 5824 CADE.tmp 2612 CB7A.tmp 2844 CC07.tmp 2940 CC84.tmp 6028 CD01.tmp 3544 CD8D.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\E: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B194.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F171.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 112E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5868.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F45F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6866.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 330E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5422.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 355F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6307.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7353.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9273.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 789.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 268A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4108.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1748.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3947.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7854.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8610.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8767.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 810E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F568.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4359.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B676.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4926.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7007.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E9B.tmp - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 39 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{8CF96F1A-A44E-44FC-8141-B62852B26860} explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{5A6F4461-13CF-4499-B9E6-38F1B76D5A98} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0200000000000002 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3700 explorer.exe 3700 explorer.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe Token: SeShutdownPrivilege 3700 explorer.exe Token: SeCreatePagefilePrivilege 3700 explorer.exe - Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 3288 sihost.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe - Suspicious use of SendNotifyMessage 38 IoCs
pid Process 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe 3700 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1180 StartMenuExperienceHost.exe 3700 explorer.exe 7040 SearchHost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1864 wrote to memory of 2840 1864 2026-07-03_9b03522e2a6f160b9c85c8bb64fb5276_elex_mafia_stealc_tofsee.exe 89 PID 2840 wrote to memory of 5852 2840 A719.tmp 90 PID 5852 wrote to memory of 2560 5852 A7C5.tmp 91 PID 2560 wrote to memory of 1240 2560 A890.tmp 92 PID 1240 wrote to memory of 3704 1240 A8FE.tmp 93 PID 3704 wrote to memory of 3784 3704 A9AA.tmp 94 PID 3784 wrote to memory of 4576 3784 AA75.tmp 95 PID 4576 wrote to memory of 4900 4576 AB21.tmp 96 PID 4900 wrote to memory of 1548 4900 ABDC.tmp 97 PID 1548 wrote to memory of 2484 1548 AC59.tmp 98 PID 2484 wrote to memory of 4484 2484 AD34.tmp 99 PID 4484 wrote to memory of 5224 4484 AE5D.tmp 100 PID 5224 wrote to memory of 5972 5224 AF47.tmp 101 PID 5972 wrote to memory of 1168 5972 AFD4.tmp 102 PID 1168 wrote to memory of 836 1168 B08F.tmp 103 PID 836 wrote to memory of 2524 836 B12C.tmp 104 PID 2524 wrote to memory of 2592 2524 B1D7.tmp 105 PID 2592 wrote to memory of 1896 2592 B2C2.tmp 106 PID 1896 wrote to memory of 5216 1896 B33F.tmp 107 PID 5216 wrote to memory of 2936 5216 B429.tmp 108 PID 2936 wrote to memory of 2500 2936 B4B6.tmp 109 PID 2500 wrote to memory of 5792 2500 B581.tmp 110 PID 5792 wrote to memory of 4384 5792 B60E.tmp 111 PID 4384 wrote to memory of 2880 4384 B6AA.tmp 112 PID 2880 wrote to memory of 3228 2880 B736.tmp 113 PID 3228 wrote to memory of 4720 3228 B7E2.tmp 114 PID 4720 wrote to memory of 5776 4720 B89E.tmp 115 PID 5776 wrote to memory of 1900 5776 B988.tmp 116 PID 1900 wrote to memory of 764 1900 BA53.tmp 117 PID 764 wrote to memory of 1496 764 BAE0.tmp 118 PID 1496 wrote to memory of 5048 1496 BB6D.tmp 119 PID 5048 wrote to memory of 472 5048 BC09.tmp 120 PID 472 wrote to memory of 848 472 BCD4.tmp 121 PID 848 wrote to memory of 1652 848 BD51.tmp 122 PID 1652 wrote to memory of 2016 1652 BDCE.tmp 123 PID 2016 wrote to memory of 2416 2016 BE5B.tmp 124 PID 2416 wrote to memory of 3200 2416 BEE7.tmp 125 PID 3200 wrote to memory of 5684 3200 BF83.tmp 126 PID 5684 wrote to memory of 4448 5684 C020.tmp 127 PID 4448 wrote to memory of 2708 4448 C09D.tmp 128 PID 2708 wrote to memory of 988 2708 C129.tmp 129 PID 988 wrote to memory of 5444 988 C1A6.tmp 130 PID 5444 wrote to memory of 1828 5444 C233.tmp 131 PID 1828 wrote to memory of 5960 1828 C2C0.tmp 132 PID 5960 wrote to memory of 1688 5960 C35C.tmp 133 PID 1688 wrote to memory of 912 1688 C3C9.tmp 134 PID 912 wrote to memory of 3180 912 C456.tmp 135 PID 3180 wrote to memory of 4648 3180 C4C3.tmp 136 PID 4648 wrote to memory of 4988 4648 C550.tmp 137 PID 4988 wrote to memory of 2776 4988 C5CD.tmp 138 PID 2776 wrote to memory of 1512 2776 C669.tmp 139 PID 1512 wrote to memory of 4000 1512 C6E6.tmp 140 PID 4000 wrote to memory of 1056 4000 C773.tmp 141 PID 1056 wrote to memory of 5400 1056 C7E0.tmp 142 PID 5400 wrote to memory of 4412 5400 C85D.tmp 143 PID 4412 wrote to memory of 2376 4412 C8DA.tmp 144 PID 2376 wrote to memory of 5720 2376 C976.tmp 145 PID 5720 wrote to memory of 2036 5720 C9D4.tmp 146 PID 2036 wrote to memory of 5824 2036 CA70.tmp 147 PID 5824 wrote to memory of 2612 5824 CADE.tmp 148 PID 2612 wrote to memory of 2844 2612 CB7A.tmp 149 PID 2844 wrote to memory of 2940 2844 CC07.tmp 150 PID 2940 wrote to memory of 6028 2940 CC84.tmp 151 PID 6028 wrote to memory of 3544 6028 CD01.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_9b03522e2a6f160b9c85c8bb64fb5276_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_9b03522e2a6f160b9c85c8bb64fb5276_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\A719.tmp"C:\Users\Admin\AppData\Local\Temp\A719.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\A7C5.tmp"C:\Users\Admin\AppData\Local\Temp\A7C5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\A890.tmp"C:\Users\Admin\AppData\Local\Temp\A890.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\A8FE.tmp"C:\Users\Admin\AppData\Local\Temp\A8FE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\A9AA.tmp"C:\Users\Admin\AppData\Local\Temp\A9AA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\AA75.tmp"C:\Users\Admin\AppData\Local\Temp\AA75.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\AB21.tmp"C:\Users\Admin\AppData\Local\Temp\AB21.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\ABDC.tmp"C:\Users\Admin\AppData\Local\Temp\ABDC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\AC59.tmp"C:\Users\Admin\AppData\Local\Temp\AC59.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\AD34.tmp"C:\Users\Admin\AppData\Local\Temp\AD34.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\AE5D.tmp"C:\Users\Admin\AppData\Local\Temp\AE5D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\AF47.tmp"C:\Users\Admin\AppData\Local\Temp\AF47.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\AFD4.tmp"C:\Users\Admin\AppData\Local\Temp\AFD4.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\B08F.tmp"C:\Users\Admin\AppData\Local\Temp\B08F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\B12C.tmp"C:\Users\Admin\AppData\Local\Temp\B12C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\B1D7.tmp"C:\Users\Admin\AppData\Local\Temp\B1D7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\B2C2.tmp"C:\Users\Admin\AppData\Local\Temp\B2C2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\B33F.tmp"C:\Users\Admin\AppData\Local\Temp\B33F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\B429.tmp"C:\Users\Admin\AppData\Local\Temp\B429.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\B4B6.tmp"C:\Users\Admin\AppData\Local\Temp\B4B6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\B581.tmp"C:\Users\Admin\AppData\Local\Temp\B581.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\B60E.tmp"C:\Users\Admin\AppData\Local\Temp\B60E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\B6AA.tmp"C:\Users\Admin\AppData\Local\Temp\B6AA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\B736.tmp"C:\Users\Admin\AppData\Local\Temp\B736.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\B7E2.tmp"C:\Users\Admin\AppData\Local\Temp\B7E2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\B89E.tmp"C:\Users\Admin\AppData\Local\Temp\B89E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\B988.tmp"C:\Users\Admin\AppData\Local\Temp\B988.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\BA53.tmp"C:\Users\Admin\AppData\Local\Temp\BA53.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\BAE0.tmp"C:\Users\Admin\AppData\Local\Temp\BAE0.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\BB6D.tmp"C:\Users\Admin\AppData\Local\Temp\BB6D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\BC09.tmp"C:\Users\Admin\AppData\Local\Temp\BC09.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\BCD4.tmp"C:\Users\Admin\AppData\Local\Temp\BCD4.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\BD51.tmp"C:\Users\Admin\AppData\Local\Temp\BD51.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\BDCE.tmp"C:\Users\Admin\AppData\Local\Temp\BDCE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\BE5B.tmp"C:\Users\Admin\AppData\Local\Temp\BE5B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\BEE7.tmp"C:\Users\Admin\AppData\Local\Temp\BEE7.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\BF83.tmp"C:\Users\Admin\AppData\Local\Temp\BF83.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\C020.tmp"C:\Users\Admin\AppData\Local\Temp\C020.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\C09D.tmp"C:\Users\Admin\AppData\Local\Temp\C09D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\C129.tmp"C:\Users\Admin\AppData\Local\Temp\C129.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\C1A6.tmp"C:\Users\Admin\AppData\Local\Temp\C1A6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\C233.tmp"C:\Users\Admin\AppData\Local\Temp\C233.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\C2C0.tmp"C:\Users\Admin\AppData\Local\Temp\C2C0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\C35C.tmp"C:\Users\Admin\AppData\Local\Temp\C35C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\C3C9.tmp"C:\Users\Admin\AppData\Local\Temp\C3C9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\C456.tmp"C:\Users\Admin\AppData\Local\Temp\C456.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\C4C3.tmp"C:\Users\Admin\AppData\Local\Temp\C4C3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\C550.tmp"C:\Users\Admin\AppData\Local\Temp\C550.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\C5CD.tmp"C:\Users\Admin\AppData\Local\Temp\C5CD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\C669.tmp"C:\Users\Admin\AppData\Local\Temp\C669.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\C6E6.tmp"C:\Users\Admin\AppData\Local\Temp\C6E6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\C773.tmp"C:\Users\Admin\AppData\Local\Temp\C773.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\C7E0.tmp"C:\Users\Admin\AppData\Local\Temp\C7E0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\C85D.tmp"C:\Users\Admin\AppData\Local\Temp\C85D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\C8DA.tmp"C:\Users\Admin\AppData\Local\Temp\C8DA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\C976.tmp"C:\Users\Admin\AppData\Local\Temp\C976.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\CADE.tmp"C:\Users\Admin\AppData\Local\Temp\CADE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\CB7A.tmp"C:\Users\Admin\AppData\Local\Temp\CB7A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\CC07.tmp"C:\Users\Admin\AppData\Local\Temp\CC07.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\CC84.tmp"C:\Users\Admin\AppData\Local\Temp\CC84.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\CD01.tmp"C:\Users\Admin\AppData\Local\Temp\CD01.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\CD8D.tmp"C:\Users\Admin\AppData\Local\Temp\CD8D.tmp"65⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\CE29.tmp"C:\Users\Admin\AppData\Local\Temp\CE29.tmp"66⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\CEA6.tmp"C:\Users\Admin\AppData\Local\Temp\CEA6.tmp"67⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\CF14.tmp"C:\Users\Admin\AppData\Local\Temp\CF14.tmp"68⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\CFA0.tmp"C:\Users\Admin\AppData\Local\Temp\CFA0.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\D01D.tmp"C:\Users\Admin\AppData\Local\Temp\D01D.tmp"70⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\D0C9.tmp"C:\Users\Admin\AppData\Local\Temp\D0C9.tmp"71⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\D156.tmp"C:\Users\Admin\AppData\Local\Temp\D156.tmp"72⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\D1E3.tmp"C:\Users\Admin\AppData\Local\Temp\D1E3.tmp"73⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\D26F.tmp"C:\Users\Admin\AppData\Local\Temp\D26F.tmp"74⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\D2EC.tmp"C:\Users\Admin\AppData\Local\Temp\D2EC.tmp"75⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\D35A.tmp"C:\Users\Admin\AppData\Local\Temp\D35A.tmp"76⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\D3E6.tmp"C:\Users\Admin\AppData\Local\Temp\D3E6.tmp"77⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\D454.tmp"C:\Users\Admin\AppData\Local\Temp\D454.tmp"78⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\D4D1.tmp"C:\Users\Admin\AppData\Local\Temp\D4D1.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\D53E.tmp"C:\Users\Admin\AppData\Local\Temp\D53E.tmp"80⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\D5BB.tmp"C:\Users\Admin\AppData\Local\Temp\D5BB.tmp"81⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\D648.tmp"C:\Users\Admin\AppData\Local\Temp\D648.tmp"82⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\D6C5.tmp"C:\Users\Admin\AppData\Local\Temp\D6C5.tmp"83⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\D742.tmp"C:\Users\Admin\AppData\Local\Temp\D742.tmp"84⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\D7CE.tmp"C:\Users\Admin\AppData\Local\Temp\D7CE.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\D85B.tmp"C:\Users\Admin\AppData\Local\Temp\D85B.tmp"86⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\D8F7.tmp"C:\Users\Admin\AppData\Local\Temp\D8F7.tmp"87⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\D974.tmp"C:\Users\Admin\AppData\Local\Temp\D974.tmp"88⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\DA20.tmp"C:\Users\Admin\AppData\Local\Temp\DA20.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\DA9D.tmp"C:\Users\Admin\AppData\Local\Temp\DA9D.tmp"90⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\DB1A.tmp"C:\Users\Admin\AppData\Local\Temp\DB1A.tmp"91⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\DB97.tmp"C:\Users\Admin\AppData\Local\Temp\DB97.tmp"92⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\DC33.tmp"C:\Users\Admin\AppData\Local\Temp\DC33.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:672 -
C:\Users\Admin\AppData\Local\Temp\DCB0.tmp"C:\Users\Admin\AppData\Local\Temp\DCB0.tmp"94⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\DD2D.tmp"C:\Users\Admin\AppData\Local\Temp\DD2D.tmp"95⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\DD9B.tmp"C:\Users\Admin\AppData\Local\Temp\DD9B.tmp"96⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\DE27.tmp"C:\Users\Admin\AppData\Local\Temp\DE27.tmp"97⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\DE95.tmp"C:\Users\Admin\AppData\Local\Temp\DE95.tmp"98⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\DF21.tmp"C:\Users\Admin\AppData\Local\Temp\DF21.tmp"99⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\DF8F.tmp"C:\Users\Admin\AppData\Local\Temp\DF8F.tmp"100⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\E00C.tmp"C:\Users\Admin\AppData\Local\Temp\E00C.tmp"101⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\E098.tmp"C:\Users\Admin\AppData\Local\Temp\E098.tmp"102⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\E106.tmp"C:\Users\Admin\AppData\Local\Temp\E106.tmp"103⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\E1A2.tmp"C:\Users\Admin\AppData\Local\Temp\E1A2.tmp"104⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\E20F.tmp"C:\Users\Admin\AppData\Local\Temp\E20F.tmp"105⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\E28C.tmp"C:\Users\Admin\AppData\Local\Temp\E28C.tmp"106⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\E319.tmp"C:\Users\Admin\AppData\Local\Temp\E319.tmp"107⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\E3B5.tmp"C:\Users\Admin\AppData\Local\Temp\E3B5.tmp"108⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\E451.tmp"C:\Users\Admin\AppData\Local\Temp\E451.tmp"109⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\E4BF.tmp"C:\Users\Admin\AppData\Local\Temp\E4BF.tmp"110⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\E53C.tmp"C:\Users\Admin\AppData\Local\Temp\E53C.tmp"111⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\E5E8.tmp"C:\Users\Admin\AppData\Local\Temp\E5E8.tmp"112⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\E684.tmp"C:\Users\Admin\AppData\Local\Temp\E684.tmp"113⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\E6F1.tmp"C:\Users\Admin\AppData\Local\Temp\E6F1.tmp"114⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\E75F.tmp"C:\Users\Admin\AppData\Local\Temp\E75F.tmp"115⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\E7DC.tmp"C:\Users\Admin\AppData\Local\Temp\E7DC.tmp"116⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\E849.tmp"C:\Users\Admin\AppData\Local\Temp\E849.tmp"117⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\E8E5.tmp"C:\Users\Admin\AppData\Local\Temp\E8E5.tmp"118⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\E962.tmp"C:\Users\Admin\AppData\Local\Temp\E962.tmp"119⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\E9EF.tmp"C:\Users\Admin\AppData\Local\Temp\E9EF.tmp"120⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\EA8B.tmp"C:\Users\Admin\AppData\Local\Temp\EA8B.tmp"121⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\EB08.tmp"C:\Users\Admin\AppData\Local\Temp\EB08.tmp"122⤵PID:6084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-