Analysis
- max time kernel
57s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_1f076e161f85e9489f28b9fba4ee73f4_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_1f076e161f85e9489f28b9fba4ee73f4_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260706-en
13 signatures
150 seconds
General
- Target 2026-07-09_1f076e161f85e9489f28b9fba4ee73f4_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260709-sdmc5acv9l
- SHA256 941b58977b840c3976708edda10ce17ee02a2f747c2a44d8e1315601fa4336d6
- MD5 1f076e161f85e9489f28b9fba4ee73f4
- SHA1 51ef8d95295ddd0fd63bc3c02bb1a08bbf1c88bb
- SHA512 936bdd005f7811c88a26df1a98248b4d5b89cf949401180adc6e8c8aa315bf4315b8adef4cde0a3e18ce30c4f6e2e1d1c616c23c108aa6a486ce7a3fbebd1f3d
- SSDEEP 12288:9U5rCOTei6bRJ8hg+EAvL5PP5DJQgy+X6VX2qZoXWjdq:9UQOJ6bRgLEy5PBtQgy/2qqGh
- TLSH T112C4F121B645C032F5D602304EE6EBB2592ABC318B26A4C73BD4B66D6F752E1E774307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 4816 7CC7.tmp 1176 7D64.tmp 4424 7E2F.tmp 4136 7EEA.tmp 4620 7FD5.tmp 2876 817B.tmp 2704 8236.tmp 1696 82F2.tmp 1836 83DC.tmp 5772 84E6.tmp 2816 85A1.tmp 4868 865D.tmp 5992 8708.tmp 2096 87D4.tmp 5672 887F.tmp 5748 8979.tmp 2240 8A45.tmp 1912 8B00.tmp 3424 8BFA.tmp 2112 8CC5.tmp 4084 8DA0.tmp 3800 8E4C.tmp 4268 8F27.tmp 4324 8FD2.tmp 1772 90AD.tmp 1440 9198.tmp 5352 9243.tmp 3932 931E.tmp 1500 93CA.tmp 868 9495.tmp 1848 9541.tmp 3372 95BE.tmp 5156 967A.tmp 2960 9725.tmp 5412 97A2.tmp 1148 982F.tmp 3024 98CB.tmp 4708 9948.tmp 4644 99F4.tmp 5868 9AB0.tmp 1020 9B2D.tmp 4280 9BB9.tmp 5576 9C46.tmp 1928 9CD3.tmp 3080 9D7E.tmp 1964 9DFB.tmp 5336 9E98.tmp 3168 9F24.tmp 2824 9FEF.tmp 5848 A06C.tmp 5312 A109.tmp 1212 A176.tmp 972 A203.tmp 5932 A29F.tmp 956 A33B.tmp 2408 A3A9.tmp 1508 A445.tmp 5616 A4E1.tmp 3752 A56E.tmp 4936 A5EB.tmp 3112 A668.tmp 1256 A714.tmp 4852 A7B0.tmp 4848 A82D.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B06A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D577.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A29F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A82D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F13C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 499D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 156E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 598B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 180D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2397.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9198.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B59A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 281B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 887F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D77A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DFB.tmp - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{6F795297-6A81-4107-A41C-3FA5AE4CE5A6} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{7F1E5E8C-3407-405E-B153-09EC0247FA4A} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0200000000000002 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1784 explorer.exe 1784 explorer.exe - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe Token: SeShutdownPrivilege 1784 explorer.exe Token: SeCreatePagefilePrivilege 1784 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 3248 sihost.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe 1784 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2612 StartMenuExperienceHost.exe 5424 SearchHost.exe 1784 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4948 wrote to memory of 4816 4948 2026-07-09_1f076e161f85e9489f28b9fba4ee73f4_elex_mafia_stealc_tofsee.exe 88 PID 4816 wrote to memory of 1176 4816 7CC7.tmp 89 PID 1176 wrote to memory of 4424 1176 7D64.tmp 90 PID 4424 wrote to memory of 4136 4424 7E2F.tmp 91 PID 4136 wrote to memory of 4620 4136 7EEA.tmp 92 PID 4620 wrote to memory of 2876 4620 7FD5.tmp 93 PID 2876 wrote to memory of 2704 2876 817B.tmp 94 PID 2704 wrote to memory of 1696 2704 8236.tmp 95 PID 1696 wrote to memory of 1836 1696 82F2.tmp 96 PID 1836 wrote to memory of 5772 1836 83DC.tmp 97 PID 5772 wrote to memory of 2816 5772 84E6.tmp 98 PID 2816 wrote to memory of 4868 2816 85A1.tmp 99 PID 4868 wrote to memory of 5992 4868 865D.tmp 100 PID 5992 wrote to memory of 2096 5992 8708.tmp 101 PID 2096 wrote to memory of 5672 2096 87D4.tmp 102 PID 5672 wrote to memory of 5748 5672 887F.tmp 103 PID 5748 wrote to memory of 2240 5748 8979.tmp 104 PID 2240 wrote to memory of 1912 2240 8A45.tmp 105 PID 1912 wrote to memory of 3424 1912 8B00.tmp 106 PID 3424 wrote to memory of 2112 3424 8BFA.tmp 107 PID 2112 wrote to memory of 4084 2112 8CC5.tmp 108 PID 4084 wrote to memory of 3800 4084 8DA0.tmp 109 PID 3800 wrote to memory of 4268 3800 8E4C.tmp 110 PID 4268 wrote to memory of 4324 4268 8F27.tmp 111 PID 4324 wrote to memory of 1772 4324 8FD2.tmp 112 PID 1772 wrote to memory of 1440 1772 90AD.tmp 113 PID 1440 wrote to memory of 5352 1440 9198.tmp 114 PID 5352 wrote to memory of 3932 5352 9243.tmp 115 PID 3932 wrote to memory of 1500 3932 931E.tmp 116 PID 1500 wrote to memory of 868 1500 93CA.tmp 117 PID 868 wrote to memory of 1848 868 9495.tmp 118 PID 1848 wrote to memory of 3372 1848 9541.tmp 119 PID 3372 wrote to memory of 5156 3372 95BE.tmp 120 PID 5156 wrote to memory of 2960 5156 967A.tmp 121 PID 2960 wrote to memory of 5412 2960 9725.tmp 122 PID 5412 wrote to memory of 1148 5412 97A2.tmp 123 PID 1148 wrote to memory of 3024 1148 982F.tmp 124 PID 3024 wrote to memory of 4708 3024 98CB.tmp 125 PID 4708 wrote to memory of 4644 4708 9948.tmp 126 PID 4644 wrote to memory of 5868 4644 99F4.tmp 127 PID 5868 wrote to memory of 1020 5868 9AB0.tmp 128 PID 1020 wrote to memory of 4280 1020 9B2D.tmp 129 PID 4280 wrote to memory of 5576 4280 9BB9.tmp 130 PID 5576 wrote to memory of 1928 5576 9C46.tmp 131 PID 1928 wrote to memory of 3080 1928 9CD3.tmp 132 PID 3080 wrote to memory of 1964 3080 9D7E.tmp 133 PID 1964 wrote to memory of 5336 1964 9DFB.tmp 134 PID 5336 wrote to memory of 3168 5336 9E98.tmp 135 PID 3168 wrote to memory of 2824 3168 9F24.tmp 136 PID 2824 wrote to memory of 5848 2824 9FEF.tmp 137 PID 5848 wrote to memory of 5312 5848 A06C.tmp 138 PID 5312 wrote to memory of 1212 5312 A109.tmp 139 PID 1212 wrote to memory of 972 1212 A176.tmp 140 PID 972 wrote to memory of 5932 972 A203.tmp 141 PID 5932 wrote to memory of 956 5932 A29F.tmp 142 PID 956 wrote to memory of 2408 956 A33B.tmp 143 PID 2408 wrote to memory of 1508 2408 A3A9.tmp 144 PID 1508 wrote to memory of 5616 1508 A445.tmp 145 PID 5616 wrote to memory of 3752 5616 A4E1.tmp 146 PID 3752 wrote to memory of 4936 3752 A56E.tmp 147 PID 4936 wrote to memory of 3112 4936 A5EB.tmp 148 PID 3112 wrote to memory of 1256 3112 A668.tmp 149 PID 1256 wrote to memory of 4852 1256 A714.tmp 150 PID 4852 wrote to memory of 4848 4852 A7B0.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_1f076e161f85e9489f28b9fba4ee73f4_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_1f076e161f85e9489f28b9fba4ee73f4_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\7D64.tmp"C:\Users\Admin\AppData\Local\Temp\7D64.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\7FD5.tmp"C:\Users\Admin\AppData\Local\Temp\7FD5.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\817B.tmp"C:\Users\Admin\AppData\Local\Temp\817B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\8236.tmp"C:\Users\Admin\AppData\Local\Temp\8236.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\82F2.tmp"C:\Users\Admin\AppData\Local\Temp\82F2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\83DC.tmp"C:\Users\Admin\AppData\Local\Temp\83DC.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\84E6.tmp"C:\Users\Admin\AppData\Local\Temp\84E6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\85A1.tmp"C:\Users\Admin\AppData\Local\Temp\85A1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\865D.tmp"C:\Users\Admin\AppData\Local\Temp\865D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\8708.tmp"C:\Users\Admin\AppData\Local\Temp\8708.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\87D4.tmp"C:\Users\Admin\AppData\Local\Temp\87D4.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\887F.tmp"C:\Users\Admin\AppData\Local\Temp\887F.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\8979.tmp"C:\Users\Admin\AppData\Local\Temp\8979.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\90AD.tmp"C:\Users\Admin\AppData\Local\Temp\90AD.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\9198.tmp"C:\Users\Admin\AppData\Local\Temp\9198.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\9243.tmp"C:\Users\Admin\AppData\Local\Temp\9243.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\931E.tmp"C:\Users\Admin\AppData\Local\Temp\931E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\93CA.tmp"C:\Users\Admin\AppData\Local\Temp\93CA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\9495.tmp"C:\Users\Admin\AppData\Local\Temp\9495.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\9541.tmp"C:\Users\Admin\AppData\Local\Temp\9541.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\967A.tmp"C:\Users\Admin\AppData\Local\Temp\967A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\9725.tmp"C:\Users\Admin\AppData\Local\Temp\9725.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\97A2.tmp"C:\Users\Admin\AppData\Local\Temp\97A2.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\982F.tmp"C:\Users\Admin\AppData\Local\Temp\982F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\98CB.tmp"C:\Users\Admin\AppData\Local\Temp\98CB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\9948.tmp"C:\Users\Admin\AppData\Local\Temp\9948.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\99F4.tmp"C:\Users\Admin\AppData\Local\Temp\99F4.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\9B2D.tmp"C:\Users\Admin\AppData\Local\Temp\9B2D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\9C46.tmp"C:\Users\Admin\AppData\Local\Temp\9C46.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\9E98.tmp"C:\Users\Admin\AppData\Local\Temp\9E98.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\9F24.tmp"C:\Users\Admin\AppData\Local\Temp\9F24.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\A06C.tmp"C:\Users\Admin\AppData\Local\Temp\A06C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\A109.tmp"C:\Users\Admin\AppData\Local\Temp\A109.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\A176.tmp"C:\Users\Admin\AppData\Local\Temp\A176.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\A203.tmp"C:\Users\Admin\AppData\Local\Temp\A203.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\A29F.tmp"C:\Users\Admin\AppData\Local\Temp\A29F.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\A3A9.tmp"C:\Users\Admin\AppData\Local\Temp\A3A9.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\A445.tmp"C:\Users\Admin\AppData\Local\Temp\A445.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\A56E.tmp"C:\Users\Admin\AppData\Local\Temp\A56E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\A714.tmp"C:\Users\Admin\AppData\Local\Temp\A714.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\A82D.tmp"C:\Users\Admin\AppData\Local\Temp\A82D.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"66⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\A975.tmp"C:\Users\Admin\AppData\Local\Temp\A975.tmp"67⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\AA11.tmp"C:\Users\Admin\AppData\Local\Temp\AA11.tmp"68⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\AACD.tmp"C:\Users\Admin\AppData\Local\Temp\AACD.tmp"69⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\AB59.tmp"C:\Users\Admin\AppData\Local\Temp\AB59.tmp"70⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\AC92.tmp"C:\Users\Admin\AppData\Local\Temp\AC92.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"73⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"74⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\AE57.tmp"C:\Users\Admin\AppData\Local\Temp\AE57.tmp"75⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\AED4.tmp"C:\Users\Admin\AppData\Local\Temp\AED4.tmp"76⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\AF61.tmp"C:\Users\Admin\AppData\Local\Temp\AF61.tmp"77⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"78⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\B06A.tmp"C:\Users\Admin\AppData\Local\Temp\B06A.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"80⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\B164.tmp"C:\Users\Admin\AppData\Local\Temp\B164.tmp"81⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"82⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"83⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"84⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"85⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\B462.tmp"C:\Users\Admin\AppData\Local\Temp\B462.tmp"86⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\B50E.tmp"C:\Users\Admin\AppData\Local\Temp\B50E.tmp"87⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\B59A.tmp"C:\Users\Admin\AppData\Local\Temp\B59A.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\B627.tmp"C:\Users\Admin\AppData\Local\Temp\B627.tmp"89⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\B685.tmp"C:\Users\Admin\AppData\Local\Temp\B685.tmp"90⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\B711.tmp"C:\Users\Admin\AppData\Local\Temp\B711.tmp"91⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\B79E.tmp"C:\Users\Admin\AppData\Local\Temp\B79E.tmp"92⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\B82B.tmp"C:\Users\Admin\AppData\Local\Temp\B82B.tmp"93⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\B8B7.tmp"C:\Users\Admin\AppData\Local\Temp\B8B7.tmp"94⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"95⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"96⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"97⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\BB47.tmp"C:\Users\Admin\AppData\Local\Temp\BB47.tmp"98⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\BC61.tmp"C:\Users\Admin\AppData\Local\Temp\BC61.tmp"100⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\BCED.tmp"C:\Users\Admin\AppData\Local\Temp\BCED.tmp"101⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"102⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\BDD8.tmp"C:\Users\Admin\AppData\Local\Temp\BDD8.tmp"103⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\BE45.tmp"C:\Users\Admin\AppData\Local\Temp\BE45.tmp"104⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"105⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"106⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\C00A.tmp"C:\Users\Admin\AppData\Local\Temp\C00A.tmp"108⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\C097.tmp"C:\Users\Admin\AppData\Local\Temp\C097.tmp"109⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\C104.tmp"C:\Users\Admin\AppData\Local\Temp\C104.tmp"110⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\C172.tmp"C:\Users\Admin\AppData\Local\Temp\C172.tmp"111⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\C1FE.tmp"C:\Users\Admin\AppData\Local\Temp\C1FE.tmp"112⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\C28B.tmp"C:\Users\Admin\AppData\Local\Temp\C28B.tmp"113⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\C2F8.tmp"C:\Users\Admin\AppData\Local\Temp\C2F8.tmp"114⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\C411.tmp"C:\Users\Admin\AppData\Local\Temp\C411.tmp"115⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\C579.tmp"C:\Users\Admin\AppData\Local\Temp\C579.tmp"116⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\C828.tmp"C:\Users\Admin\AppData\Local\Temp\C828.tmp"117⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\CA99.tmp"C:\Users\Admin\AppData\Local\Temp\CA99.tmp"118⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"119⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"120⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\D325.tmp"C:\Users\Admin\AppData\Local\Temp\D325.tmp"121⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\D383.tmp"C:\Users\Admin\AppData\Local\Temp\D383.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:4308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-