Analysis
- max time kernel
79s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 01:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_e96db5565d4d51db218be329d2362bf9_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_e96db5565d4d51db218be329d2362bf9_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
13 signatures
150 seconds
General
- Target 2026-07-05_e96db5565d4d51db218be329d2362bf9_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260705-be537afx9z
- SHA256 7edf5d85a07a8cb245496836b222cf17fc68852b83015a08f9c96bbbfe271332
- MD5 e96db5565d4d51db218be329d2362bf9
- SHA1 8a5657d112ba213394d5ca432fcbec8b9d00289c
- SHA512 3e45ae9e3652e3615cf1fe7b798c31a166a15568b0199f10a76eb915f0ef95d160be7ecf2ad07632a8ab3e160c58854c214097cb869d653bab5ebdd32617f5bc
- SSDEEP 12288:wU5rCOTeiDPY4c4NK6TW3dLLsd8llHNZ+3/v+I9hUG2VA:wUQOJDwKK6T6LvlVNGEA
- TLSH T107E4D02173D88532E9FB037859B5E6644D7EBD36A722D6CF2F8011AE0971BC09A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 2832 A4F5.tmp 2652 A62E.tmp 5500 A7D4.tmp 5148 A94B.tmp 2792 AA45.tmp 1596 AC39.tmp 4664 AD33.tmp 4488 AE6B.tmp 4776 AFB3.tmp 4544 B0EC.tmp 1848 B215.tmp 5584 B34D.tmp 3004 B495.tmp 3420 B5BE.tmp 2900 B716.tmp 1072 B82F.tmp 4940 B968.tmp 4828 BAFE.tmp 1280 BC94.tmp 3284 BDEC.tmp 5932 BF44.tmp 356 C04D.tmp 3432 C196.tmp 3440 C2FD.tmp 120 C455.tmp 5856 C55E.tmp 2572 C668.tmp 5940 C7A0.tmp 1860 C8D9.tmp 2072 CA31.tmp 5424 CB5A.tmp 424 CCB1.tmp 5980 CE09.tmp 1688 CF03.tmp 876 CFFD.tmp 4908 D0D8.tmp 1068 D201.tmp 4768 D2BC.tmp 6020 D3D5.tmp 5960 D491.tmp 2380 D55C.tmp 5116 D627.tmp 5260 D731.tmp 3736 D7EC.tmp 5324 D8B7.tmp 2992 D9C1.tmp 5144 DB19.tmp 3640 DBC5.tmp 5852 DC61.tmp 1724 DCDE.tmp 1528 DD6B.tmp 1588 DDF7.tmp 5596 DE74.tmp 2056 DF10.tmp 3680 DF9D.tmp 5364 E039.tmp 2508 E0B6.tmp 4704 E133.tmp 2816 E1DF.tmp 1084 E28B.tmp 5076 E347.tmp 2980 E3E3.tmp 1984 E46F.tmp 4996 E50C.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 893B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 458B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5625.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D306.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3138.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 331C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_e96db5565d4d51db218be329d2362bf9_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C932.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 138E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 551B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64AC.tmp - Checks SCSI registry key(s) 3 TTPs 46 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{E8D129E4-9DED-4ADC-9DEA-D5286EB17815} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{099B4701-967D-4C61-84F7-91F7D531889C} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1344 explorer.exe 1344 explorer.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 1344 explorer.exe Token: SeCreatePagefilePrivilege 1344 explorer.exe Token: SeShutdownPrivilege 1344 explorer.exe Token: SeCreatePagefilePrivilege 1344 explorer.exe Token: SeShutdownPrivilege 1344 explorer.exe Token: SeCreatePagefilePrivilege 1344 explorer.exe Token: SeShutdownPrivilege 1344 explorer.exe Token: SeCreatePagefilePrivilege 1344 explorer.exe Token: SeShutdownPrivilege 1344 explorer.exe Token: SeCreatePagefilePrivilege 1344 explorer.exe Token: SeShutdownPrivilege 1344 explorer.exe Token: SeCreatePagefilePrivilege 1344 explorer.exe Token: SeShutdownPrivilege 1344 explorer.exe Token: SeCreatePagefilePrivilege 1344 explorer.exe Token: SeShutdownPrivilege 1344 explorer.exe Token: SeCreatePagefilePrivilege 1344 explorer.exe Token: SeShutdownPrivilege 1344 explorer.exe Token: SeCreatePagefilePrivilege 1344 explorer.exe - Suspicious use of FindShellTrayWindow 16 IoCs
pid Process 6120 sihost.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe 1344 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2644 StartMenuExperienceHost.exe 2888 SearchHost.exe 1344 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4588 wrote to memory of 2832 4588 2026-07-05_e96db5565d4d51db218be329d2362bf9_elex_mafia_stealc_tofsee.exe 88 PID 2832 wrote to memory of 2652 2832 A4F5.tmp 89 PID 2652 wrote to memory of 5500 2652 A62E.tmp 90 PID 5500 wrote to memory of 5148 5500 A7D4.tmp 91 PID 5148 wrote to memory of 2792 5148 A94B.tmp 92 PID 2792 wrote to memory of 1596 2792 AA45.tmp 93 PID 1596 wrote to memory of 4664 1596 AC39.tmp 94 PID 4664 wrote to memory of 4488 4664 AD33.tmp 95 PID 4488 wrote to memory of 4776 4488 AE6B.tmp 96 PID 4776 wrote to memory of 4544 4776 AFB3.tmp 97 PID 4544 wrote to memory of 1848 4544 B0EC.tmp 98 PID 1848 wrote to memory of 5584 1848 B215.tmp 99 PID 5584 wrote to memory of 3004 5584 B34D.tmp 100 PID 3004 wrote to memory of 3420 3004 B495.tmp 101 PID 3420 wrote to memory of 2900 3420 B5BE.tmp 102 PID 2900 wrote to memory of 1072 2900 B716.tmp 103 PID 1072 wrote to memory of 4940 1072 B82F.tmp 104 PID 4940 wrote to memory of 4828 4940 B968.tmp 105 PID 4828 wrote to memory of 1280 4828 BAFE.tmp 106 PID 1280 wrote to memory of 3284 1280 BC94.tmp 107 PID 3284 wrote to memory of 5932 3284 BDEC.tmp 108 PID 5932 wrote to memory of 356 5932 BF44.tmp 109 PID 356 wrote to memory of 3432 356 C04D.tmp 110 PID 3432 wrote to memory of 3440 3432 C196.tmp 111 PID 3440 wrote to memory of 120 3440 C2FD.tmp 112 PID 120 wrote to memory of 5856 120 C455.tmp 113 PID 5856 wrote to memory of 2572 5856 C55E.tmp 114 PID 2572 wrote to memory of 5940 2572 C668.tmp 115 PID 5940 wrote to memory of 1860 5940 C7A0.tmp 116 PID 1860 wrote to memory of 2072 1860 C8D9.tmp 117 PID 2072 wrote to memory of 5424 2072 CA31.tmp 118 PID 5424 wrote to memory of 424 5424 CB5A.tmp 119 PID 424 wrote to memory of 5980 424 CCB1.tmp 120 PID 5980 wrote to memory of 1688 5980 CE09.tmp 121 PID 1688 wrote to memory of 876 1688 CF03.tmp 122 PID 876 wrote to memory of 4908 876 CFFD.tmp 123 PID 4908 wrote to memory of 1068 4908 D0D8.tmp 124 PID 1068 wrote to memory of 4768 1068 D201.tmp 125 PID 4768 wrote to memory of 6020 4768 D2BC.tmp 126 PID 6020 wrote to memory of 5960 6020 D3D5.tmp 127 PID 5960 wrote to memory of 2380 5960 D491.tmp 128 PID 2380 wrote to memory of 5116 2380 D55C.tmp 129 PID 5116 wrote to memory of 5260 5116 D627.tmp 130 PID 5260 wrote to memory of 3736 5260 D731.tmp 131 PID 3736 wrote to memory of 5324 3736 D7EC.tmp 132 PID 5324 wrote to memory of 2992 5324 D8B7.tmp 133 PID 2992 wrote to memory of 5144 2992 D9C1.tmp 134 PID 5144 wrote to memory of 3640 5144 DB19.tmp 135 PID 3640 wrote to memory of 5852 3640 DBC5.tmp 136 PID 5852 wrote to memory of 1724 5852 DC61.tmp 137 PID 1724 wrote to memory of 1528 1724 DCDE.tmp 138 PID 1528 wrote to memory of 1588 1528 DD6B.tmp 139 PID 1588 wrote to memory of 5596 1588 DDF7.tmp 140 PID 5596 wrote to memory of 2056 5596 DE74.tmp 141 PID 2056 wrote to memory of 3680 2056 DF10.tmp 142 PID 3680 wrote to memory of 5364 3680 DF9D.tmp 143 PID 5364 wrote to memory of 2508 5364 E039.tmp 144 PID 2508 wrote to memory of 4704 2508 E0B6.tmp 145 PID 4704 wrote to memory of 2816 4704 E133.tmp 146 PID 2816 wrote to memory of 1084 2816 E1DF.tmp 147 PID 1084 wrote to memory of 5076 1084 E28B.tmp 148 PID 5076 wrote to memory of 2980 5076 E347.tmp 149 PID 2980 wrote to memory of 1984 2980 E3E3.tmp 150 PID 1984 wrote to memory of 4996 1984 E46F.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_e96db5565d4d51db218be329d2362bf9_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_e96db5565d4d51db218be329d2362bf9_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\A7D4.tmp"C:\Users\Admin\AppData\Local\Temp\A7D4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\A94B.tmp"C:\Users\Admin\AppData\Local\Temp\A94B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\AA45.tmp"C:\Users\Admin\AppData\Local\Temp\AA45.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\AC39.tmp"C:\Users\Admin\AppData\Local\Temp\AC39.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\AD33.tmp"C:\Users\Admin\AppData\Local\Temp\AD33.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\AE6B.tmp"C:\Users\Admin\AppData\Local\Temp\AE6B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\B0EC.tmp"C:\Users\Admin\AppData\Local\Temp\B0EC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\B215.tmp"C:\Users\Admin\AppData\Local\Temp\B215.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\B34D.tmp"C:\Users\Admin\AppData\Local\Temp\B34D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\B495.tmp"C:\Users\Admin\AppData\Local\Temp\B495.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\B5BE.tmp"C:\Users\Admin\AppData\Local\Temp\B5BE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\B716.tmp"C:\Users\Admin\AppData\Local\Temp\B716.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\B82F.tmp"C:\Users\Admin\AppData\Local\Temp\B82F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\B968.tmp"C:\Users\Admin\AppData\Local\Temp\B968.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\BC94.tmp"C:\Users\Admin\AppData\Local\Temp\BC94.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\BF44.tmp"C:\Users\Admin\AppData\Local\Temp\BF44.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\C04D.tmp"C:\Users\Admin\AppData\Local\Temp\C04D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Users\Admin\AppData\Local\Temp\C196.tmp"C:\Users\Admin\AppData\Local\Temp\C196.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\C455.tmp"C:\Users\Admin\AppData\Local\Temp\C455.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\C55E.tmp"C:\Users\Admin\AppData\Local\Temp\C55E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\C668.tmp"C:\Users\Admin\AppData\Local\Temp\C668.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\C7A0.tmp"C:\Users\Admin\AppData\Local\Temp\C7A0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\CA31.tmp"C:\Users\Admin\AppData\Local\Temp\CA31.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\CF03.tmp"C:\Users\Admin\AppData\Local\Temp\CF03.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\D201.tmp"C:\Users\Admin\AppData\Local\Temp\D201.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\D491.tmp"C:\Users\Admin\AppData\Local\Temp\D491.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\D55C.tmp"C:\Users\Admin\AppData\Local\Temp\D55C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\D627.tmp"C:\Users\Admin\AppData\Local\Temp\D627.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\D731.tmp"C:\Users\Admin\AppData\Local\Temp\D731.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\DB19.tmp"C:\Users\Admin\AppData\Local\Temp\DB19.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\DC61.tmp"C:\Users\Admin\AppData\Local\Temp\DC61.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\DCDE.tmp"C:\Users\Admin\AppData\Local\Temp\DCDE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\DDF7.tmp"C:\Users\Admin\AppData\Local\Temp\DDF7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\DE74.tmp"C:\Users\Admin\AppData\Local\Temp\DE74.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\DF10.tmp"C:\Users\Admin\AppData\Local\Temp\DF10.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\E039.tmp"C:\Users\Admin\AppData\Local\Temp\E039.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\E133.tmp"C:\Users\Admin\AppData\Local\Temp\E133.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\E1DF.tmp"C:\Users\Admin\AppData\Local\Temp\E1DF.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\E28B.tmp"C:\Users\Admin\AppData\Local\Temp\E28B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\E347.tmp"C:\Users\Admin\AppData\Local\Temp\E347.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\E3E3.tmp"C:\Users\Admin\AppData\Local\Temp\E3E3.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\E46F.tmp"C:\Users\Admin\AppData\Local\Temp\E46F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\E50C.tmp"C:\Users\Admin\AppData\Local\Temp\E50C.tmp"65⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"66⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\E644.tmp"C:\Users\Admin\AppData\Local\Temp\E644.tmp"67⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\E700.tmp"C:\Users\Admin\AppData\Local\Temp\E700.tmp"68⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\E79C.tmp"C:\Users\Admin\AppData\Local\Temp\E79C.tmp"69⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\E829.tmp"C:\Users\Admin\AppData\Local\Temp\E829.tmp"70⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"71⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\E942.tmp"C:\Users\Admin\AppData\Local\Temp\E942.tmp"72⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"73⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"74⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\EAF7.tmp"C:\Users\Admin\AppData\Local\Temp\EAF7.tmp"75⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\EB74.tmp"C:\Users\Admin\AppData\Local\Temp\EB74.tmp"76⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\EC01.tmp"C:\Users\Admin\AppData\Local\Temp\EC01.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\ECCC.tmp"C:\Users\Admin\AppData\Local\Temp\ECCC.tmp"78⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\ED78.tmp"C:\Users\Admin\AppData\Local\Temp\ED78.tmp"79⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\EDE5.tmp"C:\Users\Admin\AppData\Local\Temp\EDE5.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\EE91.tmp"C:\Users\Admin\AppData\Local\Temp\EE91.tmp"81⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"82⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"83⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\F056.tmp"C:\Users\Admin\AppData\Local\Temp\F056.tmp"84⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\F0E3.tmp"C:\Users\Admin\AppData\Local\Temp\F0E3.tmp"85⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\F18F.tmp"C:\Users\Admin\AppData\Local\Temp\F18F.tmp"86⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"87⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"88⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"89⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"90⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\F45E.tmp"C:\Users\Admin\AppData\Local\Temp\F45E.tmp"91⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"92⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\F577.tmp"C:\Users\Admin\AppData\Local\Temp\F577.tmp"93⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\F623.tmp"C:\Users\Admin\AppData\Local\Temp\F623.tmp"94⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\F6A0.tmp"C:\Users\Admin\AppData\Local\Temp\F6A0.tmp"95⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\F73C.tmp"C:\Users\Admin\AppData\Local\Temp\F73C.tmp"96⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"97⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\F865.tmp"C:\Users\Admin\AppData\Local\Temp\F865.tmp"98⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\F97E.tmp"C:\Users\Admin\AppData\Local\Temp\F97E.tmp"100⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"101⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\FAB7.tmp"C:\Users\Admin\AppData\Local\Temp\FAB7.tmp"102⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\FB43.tmp"C:\Users\Admin\AppData\Local\Temp\FB43.tmp"103⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"104⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"105⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\FD08.tmp"C:\Users\Admin\AppData\Local\Temp\FD08.tmp"106⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"107⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\FE22.tmp"C:\Users\Admin\AppData\Local\Temp\FE22.tmp"108⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\FECD.tmp"C:\Users\Admin\AppData\Local\Temp\FECD.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\FF6A.tmp"C:\Users\Admin\AppData\Local\Temp\FF6A.tmp"110⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\6.tmp"C:\Users\Admin\AppData\Local\Temp\6.tmp"111⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\93.tmp"C:\Users\Admin\AppData\Local\Temp\93.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\12F.tmp"C:\Users\Admin\AppData\Local\Temp\12F.tmp"113⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\1AC.tmp"C:\Users\Admin\AppData\Local\Temp\1AC.tmp"114⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\248.tmp"C:\Users\Admin\AppData\Local\Temp\248.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\2C5.tmp"C:\Users\Admin\AppData\Local\Temp\2C5.tmp"116⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\342.tmp"C:\Users\Admin\AppData\Local\Temp\342.tmp"117⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\3BF.tmp"C:\Users\Admin\AppData\Local\Temp\3BF.tmp"118⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\45B.tmp"C:\Users\Admin\AppData\Local\Temp\45B.tmp"119⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\4D8.tmp"C:\Users\Admin\AppData\Local\Temp\4D8.tmp"120⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\575.tmp"C:\Users\Admin\AppData\Local\Temp\575.tmp"121⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\601.tmp"C:\Users\Admin\AppData\Local\Temp\601.tmp"122⤵PID:1376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-