Analysis
- max time kernel
78s - max time network
103s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_c72a885ef4e434bef6bf2898a074d53f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_c72a885ef4e434bef6bf2898a074d53f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260706-en
13 signatures
150 seconds
General
- Target 2026-07-08_c72a885ef4e434bef6bf2898a074d53f_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260708-ve652ad14w
- SHA256 6b868c9f641b98684eb85714726d4b536681ec2540b9e3c8ecf6d2afe8396f2d
- MD5 c72a885ef4e434bef6bf2898a074d53f
- SHA1 255c5ff877226f1712cea21278b296bb65895453
- SHA512 6fb8197dc3018e64de2051e4db3472f6196afbbd031c613914a3e1d36618609317fdff1bc81c8b286e90c70f98e5541c89abdaff292d8df0d6efec4f02f688c6
- SSDEEP 12288:9U5rCOTei6OsAYBTbsy9FhyyJB+LJAW7bFqZoXWjdq:9UQOJ6OsL0y9FtBkJFqqGh
- TLSH T1AEC4F122B545C032E59202314AE6EBB2593EBC354B26A4C77BC0776E2FB52E1E775307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 5552 41C2.tmp 480 423F.tmp 3492 42DB.tmp 5372 4378.tmp 4764 4472.tmp 2068 44DF.tmp 5992 458B.tmp 2772 4637.tmp 3160 46B4.tmp 2480 4740.tmp 2440 480B.tmp 3140 48F6.tmp 3396 49B1.tmp 2396 4A7C.tmp 4920 4B38.tmp 5784 4C13.tmp 2220 4CAF.tmp 3528 4D6A.tmp 4204 4E36.tmp 5316 4EF1.tmp 5828 4FBC.tmp 4656 5078.tmp 5496 50F5.tmp 752 5172.tmp 5644 521E.tmp 1976 52D9.tmp 1804 5375.tmp 6032 5412.tmp 108 54AE.tmp 2908 552B.tmp 2472 55C7.tmp 4308 5654.tmp 5596 571F.tmp 5412 579C.tmp 2816 5809.tmp 5092 5886.tmp 5436 5903.tmp 4736 5980.tmp 2488 59EE.tmp 3004 5A6B.tmp 4424 5AD8.tmp 1500 5B65.tmp 5672 5BD2.tmp 5780 5C3F.tmp 2628 5C9D.tmp 3092 5D0A.tmp 1108 5D97.tmp 1848 5E04.tmp 2664 5E72.tmp 2896 5EDF.tmp 2336 5F5C.tmp 3220 5FCA.tmp 5048 6037.tmp 2708 60A4.tmp 5028 6121.tmp 1120 618F.tmp 2444 620C.tmp 708 6298.tmp 3388 6315.tmp 992 6383.tmp 3860 6400.tmp 4680 645D.tmp 1056 64DA.tmp 1176 6567.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 458B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9774.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5412.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B414.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 697E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F449.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9948.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2154.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 371F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5654.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 635F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6680.tmp - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\NotificationData explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{72F05DBA-F4B6-40B1-8DE5-08F43A0A7843} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{E3D893A3-6ADB-463E-81F6-E77B04D4E7B9} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2944 explorer.exe 2944 explorer.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe Token: SeShutdownPrivilege 2944 explorer.exe Token: SeCreatePagefilePrivilege 2944 explorer.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 1880 sihost.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2792 StartMenuExperienceHost.exe 2944 explorer.exe 3244 SearchHost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3844 wrote to memory of 5552 3844 2026-07-08_c72a885ef4e434bef6bf2898a074d53f_elex_mafia_stealc_tofsee.exe 88 PID 5552 wrote to memory of 480 5552 41C2.tmp 89 PID 480 wrote to memory of 3492 480 423F.tmp 90 PID 3492 wrote to memory of 5372 3492 42DB.tmp 91 PID 5372 wrote to memory of 4764 5372 4378.tmp 92 PID 4764 wrote to memory of 2068 4764 4472.tmp 93 PID 2068 wrote to memory of 5992 2068 44DF.tmp 94 PID 5992 wrote to memory of 2772 5992 458B.tmp 95 PID 2772 wrote to memory of 3160 2772 4637.tmp 96 PID 3160 wrote to memory of 2480 3160 46B4.tmp 97 PID 2480 wrote to memory of 2440 2480 4740.tmp 98 PID 2440 wrote to memory of 3140 2440 480B.tmp 99 PID 3140 wrote to memory of 3396 3140 48F6.tmp 100 PID 3396 wrote to memory of 2396 3396 49B1.tmp 101 PID 2396 wrote to memory of 4920 2396 4A7C.tmp 102 PID 4920 wrote to memory of 5784 4920 4B38.tmp 103 PID 5784 wrote to memory of 2220 5784 4C13.tmp 104 PID 2220 wrote to memory of 3528 2220 4CAF.tmp 105 PID 3528 wrote to memory of 4204 3528 4D6A.tmp 106 PID 4204 wrote to memory of 5316 4204 4E36.tmp 107 PID 5316 wrote to memory of 5828 5316 4EF1.tmp 108 PID 5828 wrote to memory of 4656 5828 4FBC.tmp 109 PID 4656 wrote to memory of 5496 4656 5078.tmp 110 PID 5496 wrote to memory of 752 5496 50F5.tmp 111 PID 752 wrote to memory of 5644 752 5172.tmp 112 PID 5644 wrote to memory of 1976 5644 521E.tmp 113 PID 1976 wrote to memory of 1804 1976 52D9.tmp 114 PID 1804 wrote to memory of 6032 1804 5375.tmp 115 PID 6032 wrote to memory of 108 6032 5412.tmp 116 PID 108 wrote to memory of 2908 108 54AE.tmp 117 PID 2908 wrote to memory of 2472 2908 552B.tmp 118 PID 2472 wrote to memory of 4308 2472 55C7.tmp 119 PID 4308 wrote to memory of 5596 4308 5654.tmp 120 PID 5596 wrote to memory of 5412 5596 571F.tmp 121 PID 5412 wrote to memory of 2816 5412 579C.tmp 122 PID 2816 wrote to memory of 5092 2816 5809.tmp 123 PID 5092 wrote to memory of 5436 5092 5886.tmp 124 PID 5436 wrote to memory of 4736 5436 5903.tmp 125 PID 4736 wrote to memory of 2488 4736 5980.tmp 126 PID 2488 wrote to memory of 3004 2488 59EE.tmp 127 PID 3004 wrote to memory of 4424 3004 5A6B.tmp 128 PID 4424 wrote to memory of 1500 4424 5AD8.tmp 129 PID 1500 wrote to memory of 5672 1500 5B65.tmp 130 PID 5672 wrote to memory of 5780 5672 5BD2.tmp 131 PID 5780 wrote to memory of 2628 5780 5C3F.tmp 132 PID 2628 wrote to memory of 3092 2628 5C9D.tmp 133 PID 3092 wrote to memory of 1108 3092 5D0A.tmp 134 PID 1108 wrote to memory of 1848 1108 5D97.tmp 135 PID 1848 wrote to memory of 2664 1848 5E04.tmp 136 PID 2664 wrote to memory of 2896 2664 5E72.tmp 137 PID 2896 wrote to memory of 2336 2896 5EDF.tmp 138 PID 2336 wrote to memory of 3220 2336 5F5C.tmp 139 PID 3220 wrote to memory of 5048 3220 5FCA.tmp 140 PID 5048 wrote to memory of 2708 5048 6037.tmp 141 PID 2708 wrote to memory of 5028 2708 60A4.tmp 142 PID 5028 wrote to memory of 1120 5028 6121.tmp 143 PID 1120 wrote to memory of 2444 1120 618F.tmp 144 PID 2444 wrote to memory of 708 2444 620C.tmp 145 PID 708 wrote to memory of 3388 708 6298.tmp 146 PID 3388 wrote to memory of 992 3388 6315.tmp 147 PID 992 wrote to memory of 3860 992 6383.tmp 148 PID 3860 wrote to memory of 4680 3860 6400.tmp 149 PID 4680 wrote to memory of 1056 4680 645D.tmp 150 PID 1056 wrote to memory of 1176 1056 64DA.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_c72a885ef4e434bef6bf2898a074d53f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_c72a885ef4e434bef6bf2898a074d53f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\41C2.tmp"C:\Users\Admin\AppData\Local\Temp\41C2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\423F.tmp"C:\Users\Admin\AppData\Local\Temp\423F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\42DB.tmp"C:\Users\Admin\AppData\Local\Temp\42DB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\4378.tmp"C:\Users\Admin\AppData\Local\Temp\4378.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\4472.tmp"C:\Users\Admin\AppData\Local\Temp\4472.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\44DF.tmp"C:\Users\Admin\AppData\Local\Temp\44DF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\458B.tmp"C:\Users\Admin\AppData\Local\Temp\458B.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\4637.tmp"C:\Users\Admin\AppData\Local\Temp\4637.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\46B4.tmp"C:\Users\Admin\AppData\Local\Temp\46B4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\4740.tmp"C:\Users\Admin\AppData\Local\Temp\4740.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\480B.tmp"C:\Users\Admin\AppData\Local\Temp\480B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\48F6.tmp"C:\Users\Admin\AppData\Local\Temp\48F6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\49B1.tmp"C:\Users\Admin\AppData\Local\Temp\49B1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4B38.tmp"C:\Users\Admin\AppData\Local\Temp\4B38.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\4C13.tmp"C:\Users\Admin\AppData\Local\Temp\4C13.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\4E36.tmp"C:\Users\Admin\AppData\Local\Temp\4E36.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\5078.tmp"C:\Users\Admin\AppData\Local\Temp\5078.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\50F5.tmp"C:\Users\Admin\AppData\Local\Temp\50F5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\5172.tmp"C:\Users\Admin\AppData\Local\Temp\5172.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\521E.tmp"C:\Users\Admin\AppData\Local\Temp\521E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\52D9.tmp"C:\Users\Admin\AppData\Local\Temp\52D9.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\5375.tmp"C:\Users\Admin\AppData\Local\Temp\5375.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\5412.tmp"C:\Users\Admin\AppData\Local\Temp\5412.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\54AE.tmp"C:\Users\Admin\AppData\Local\Temp\54AE.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\552B.tmp"C:\Users\Admin\AppData\Local\Temp\552B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\55C7.tmp"C:\Users\Admin\AppData\Local\Temp\55C7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\5654.tmp"C:\Users\Admin\AppData\Local\Temp\5654.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\571F.tmp"C:\Users\Admin\AppData\Local\Temp\571F.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\579C.tmp"C:\Users\Admin\AppData\Local\Temp\579C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\5809.tmp"C:\Users\Admin\AppData\Local\Temp\5809.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5886.tmp"C:\Users\Admin\AppData\Local\Temp\5886.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\5903.tmp"C:\Users\Admin\AppData\Local\Temp\5903.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\5980.tmp"C:\Users\Admin\AppData\Local\Temp\5980.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\59EE.tmp"C:\Users\Admin\AppData\Local\Temp\59EE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\5AD8.tmp"C:\Users\Admin\AppData\Local\Temp\5AD8.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\5B65.tmp"C:\Users\Admin\AppData\Local\Temp\5B65.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\5BD2.tmp"C:\Users\Admin\AppData\Local\Temp\5BD2.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\5C3F.tmp"C:\Users\Admin\AppData\Local\Temp\5C3F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\5C9D.tmp"C:\Users\Admin\AppData\Local\Temp\5C9D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\5D97.tmp"C:\Users\Admin\AppData\Local\Temp\5D97.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\5E04.tmp"C:\Users\Admin\AppData\Local\Temp\5E04.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\5E72.tmp"C:\Users\Admin\AppData\Local\Temp\5E72.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\5F5C.tmp"C:\Users\Admin\AppData\Local\Temp\5F5C.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\6037.tmp"C:\Users\Admin\AppData\Local\Temp\6037.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\60A4.tmp"C:\Users\Admin\AppData\Local\Temp\60A4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\6121.tmp"C:\Users\Admin\AppData\Local\Temp\6121.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\618F.tmp"C:\Users\Admin\AppData\Local\Temp\618F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\620C.tmp"C:\Users\Admin\AppData\Local\Temp\620C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\6298.tmp"C:\Users\Admin\AppData\Local\Temp\6298.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\6315.tmp"C:\Users\Admin\AppData\Local\Temp\6315.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\6400.tmp"C:\Users\Admin\AppData\Local\Temp\6400.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\645D.tmp"C:\Users\Admin\AppData\Local\Temp\645D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\64DA.tmp"C:\Users\Admin\AppData\Local\Temp\64DA.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"65⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"66⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"68⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\67D8.tmp"C:\Users\Admin\AppData\Local\Temp\67D8.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\6865.tmp"C:\Users\Admin\AppData\Local\Temp\6865.tmp"70⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\68F1.tmp"C:\Users\Admin\AppData\Local\Temp\68F1.tmp"71⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\697E.tmp"C:\Users\Admin\AppData\Local\Temp\697E.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\69FB.tmp"C:\Users\Admin\AppData\Local\Temp\69FB.tmp"73⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"74⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"75⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"76⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"77⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"78⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\6D27.tmp"C:\Users\Admin\AppData\Local\Temp\6D27.tmp"79⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"80⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\6E60.tmp"C:\Users\Admin\AppData\Local\Temp\6E60.tmp"81⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"82⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\6F98.tmp"C:\Users\Admin\AppData\Local\Temp\6F98.tmp"83⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"84⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\70B2.tmp"C:\Users\Admin\AppData\Local\Temp\70B2.tmp"85⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\713E.tmp"C:\Users\Admin\AppData\Local\Temp\713E.tmp"86⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\71CB.tmp"C:\Users\Admin\AppData\Local\Temp\71CB.tmp"87⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\7248.tmp"C:\Users\Admin\AppData\Local\Temp\7248.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\72B5.tmp"C:\Users\Admin\AppData\Local\Temp\72B5.tmp"89⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\7342.tmp"C:\Users\Admin\AppData\Local\Temp\7342.tmp"90⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\73BF.tmp"C:\Users\Admin\AppData\Local\Temp\73BF.tmp"91⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\744C.tmp"C:\Users\Admin\AppData\Local\Temp\744C.tmp"92⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\74E8.tmp"C:\Users\Admin\AppData\Local\Temp\74E8.tmp"93⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\7565.tmp"C:\Users\Admin\AppData\Local\Temp\7565.tmp"94⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\7601.tmp"C:\Users\Admin\AppData\Local\Temp\7601.tmp"95⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\767E.tmp"C:\Users\Admin\AppData\Local\Temp\767E.tmp"96⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\772A.tmp"C:\Users\Admin\AppData\Local\Temp\772A.tmp"97⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\77D6.tmp"C:\Users\Admin\AppData\Local\Temp\77D6.tmp"98⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\7891.tmp"C:\Users\Admin\AppData\Local\Temp\7891.tmp"99⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\790E.tmp"C:\Users\Admin\AppData\Local\Temp\790E.tmp"100⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\79BA.tmp"C:\Users\Admin\AppData\Local\Temp\79BA.tmp"101⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\7A56.tmp"C:\Users\Admin\AppData\Local\Temp\7A56.tmp"102⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"103⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"104⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"105⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\7C89.tmp"C:\Users\Admin\AppData\Local\Temp\7C89.tmp"106⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\7D06.tmp"C:\Users\Admin\AppData\Local\Temp\7D06.tmp"107⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\7D83.tmp"C:\Users\Admin\AppData\Local\Temp\7D83.tmp"108⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"109⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\7E5E.tmp"C:\Users\Admin\AppData\Local\Temp\7E5E.tmp"110⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"111⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\7F77.tmp"C:\Users\Admin\AppData\Local\Temp\7F77.tmp"112⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"113⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\8090.tmp"C:\Users\Admin\AppData\Local\Temp\8090.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\811D.tmp"C:\Users\Admin\AppData\Local\Temp\811D.tmp"115⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"116⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\8236.tmp"C:\Users\Admin\AppData\Local\Temp\8236.tmp"117⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\82C3.tmp"C:\Users\Admin\AppData\Local\Temp\82C3.tmp"118⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\834F.tmp"C:\Users\Admin\AppData\Local\Temp\834F.tmp"119⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\83BD.tmp"C:\Users\Admin\AppData\Local\Temp\83BD.tmp"120⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\8459.tmp"C:\Users\Admin\AppData\Local\Temp\8459.tmp"121⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\84D6.tmp"C:\Users\Admin\AppData\Local\Temp\84D6.tmp"122⤵PID:5768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-