Analysis
- max time kernel
132s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 10:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-30_61d2ff8b44db0bb2127281021a00ecdd_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-30_61d2ff8b44db0bb2127281021a00ecdd_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-30_61d2ff8b44db0bb2127281021a00ecdd_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260831-mnbfqazeph
- SHA256 47221d525f755af078846ecd634611c52ad155a513109901017166dbb400bda2
- MD5 61d2ff8b44db0bb2127281021a00ecdd
- SHA1 27f70f3a2aec5a9edc3fb63bfaa8edb2ffc4deff
- SHA512 478cf979159f9aff2e3d380ef25a562cf5d37067f0a4b02abd0c5df3d56ed78263a122c9a4760bf0711d99f1526ff5e8741a386e2b956f3ad82bf846a10947aa
- SSDEEP 12288:9U5rCOTei6jdmf7Z500DbZaaLVW+X4vL1skb7QcqZoXWjdq:9UQOJ6Rmfb04aaJ0zC47QcqqGh
- TLSH T1C8C4F121B584C036E9D211314BE6EBA1697B7C315B22A4C77BC0776EAFB12E1D335346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6056 8802.tmp 3168 88BE.tmp 1388 892B.tmp 260 89E7.tmp 2388 8A83.tmp 4220 8B00.tmp 5900 8B6D.tmp 2072 8BFA.tmp 5700 8CC5.tmp 1528 8D71.tmp 5920 8E5B.tmp 4500 8F36.tmp 5468 8FB3.tmp 2192 9040.tmp 4792 910B.tmp 1120 91A7.tmp 4812 9272.tmp 5672 92FF.tmp 1504 93DA.tmp 1420 94A5.tmp 744 9541.tmp 4544 963B.tmp 2344 96D7.tmp 2304 97E1.tmp 2432 98AC.tmp 5376 9948.tmp 4052 9A13.tmp 2908 9ACF.tmp 5444 9B6B.tmp 4692 9C75.tmp 2600 9D40.tmp 6104 9E1B.tmp 1256 9EE6.tmp 2448 9F63.tmp 2352 9FE0.tmp 1520 A03E.tmp 5780 A0BB.tmp 5244 A128.tmp 4304 A1A5.tmp 3816 A212.tmp 4196 A28F.tmp 4248 A31C.tmp 3208 A399.tmp 5368 A416.tmp 3496 A493.tmp 5196 A52F.tmp 2672 A59D.tmp 5840 A61A.tmp 4516 A697.tmp 1608 A714.tmp 4308 A791.tmp 4568 A7FE.tmp 892 A87B.tmp 4588 A8F8.tmp 5364 A965.tmp 4224 A9E2.tmp 1828 AA7F.tmp 940 AAFC.tmp 1740 AB69.tmp 4604 ABE6.tmp 2472 AC73.tmp 5300 ACFF.tmp 5048 AD6D.tmp 5288 AE09.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7020.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6156.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F57D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F156.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 831C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F66C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 662D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5669.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F250.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 438D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 599B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2259.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D140.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE60.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 6056 2396 2026-08-30_61d2ff8b44db0bb2127281021a00ecdd_elex_mafia_stealc_tofsee.exe 89 PID 6056 wrote to memory of 3168 6056 8802.tmp 90 PID 3168 wrote to memory of 1388 3168 88BE.tmp 91 PID 1388 wrote to memory of 260 1388 892B.tmp 92 PID 260 wrote to memory of 2388 260 89E7.tmp 93 PID 2388 wrote to memory of 4220 2388 8A83.tmp 94 PID 4220 wrote to memory of 5900 4220 8B00.tmp 95 PID 5900 wrote to memory of 2072 5900 8B6D.tmp 96 PID 2072 wrote to memory of 5700 2072 8BFA.tmp 97 PID 5700 wrote to memory of 1528 5700 8CC5.tmp 98 PID 1528 wrote to memory of 5920 1528 8D71.tmp 99 PID 5920 wrote to memory of 4500 5920 8E5B.tmp 100 PID 4500 wrote to memory of 5468 4500 8F36.tmp 101 PID 5468 wrote to memory of 2192 5468 8FB3.tmp 102 PID 2192 wrote to memory of 4792 2192 9040.tmp 103 PID 4792 wrote to memory of 1120 4792 910B.tmp 104 PID 1120 wrote to memory of 4812 1120 91A7.tmp 105 PID 4812 wrote to memory of 5672 4812 9272.tmp 106 PID 5672 wrote to memory of 1504 5672 92FF.tmp 107 PID 1504 wrote to memory of 1420 1504 93DA.tmp 108 PID 1420 wrote to memory of 744 1420 94A5.tmp 109 PID 744 wrote to memory of 4544 744 9541.tmp 110 PID 4544 wrote to memory of 2344 4544 963B.tmp 111 PID 2344 wrote to memory of 2304 2344 96D7.tmp 112 PID 2304 wrote to memory of 2432 2304 97E1.tmp 113 PID 2432 wrote to memory of 5376 2432 98AC.tmp 114 PID 5376 wrote to memory of 4052 5376 9948.tmp 115 PID 4052 wrote to memory of 2908 4052 9A13.tmp 116 PID 2908 wrote to memory of 5444 2908 9ACF.tmp 117 PID 5444 wrote to memory of 4692 5444 9B6B.tmp 118 PID 4692 wrote to memory of 2600 4692 9C75.tmp 119 PID 2600 wrote to memory of 6104 2600 9D40.tmp 120 PID 6104 wrote to memory of 1256 6104 9E1B.tmp 121 PID 1256 wrote to memory of 2448 1256 9EE6.tmp 122 PID 2448 wrote to memory of 2352 2448 9F63.tmp 123 PID 2352 wrote to memory of 1520 2352 9FE0.tmp 124 PID 1520 wrote to memory of 5780 1520 A03E.tmp 125 PID 5780 wrote to memory of 5244 5780 A0BB.tmp 126 PID 5244 wrote to memory of 4304 5244 A128.tmp 127 PID 4304 wrote to memory of 3816 4304 A1A5.tmp 128 PID 3816 wrote to memory of 4196 3816 A212.tmp 129 PID 4196 wrote to memory of 4248 4196 A28F.tmp 130 PID 4248 wrote to memory of 3208 4248 A31C.tmp 131 PID 3208 wrote to memory of 5368 3208 A399.tmp 132 PID 5368 wrote to memory of 3496 5368 A416.tmp 133 PID 3496 wrote to memory of 5196 3496 A493.tmp 134 PID 5196 wrote to memory of 2672 5196 A52F.tmp 135 PID 2672 wrote to memory of 5840 2672 A59D.tmp 136 PID 5840 wrote to memory of 4516 5840 A61A.tmp 137 PID 4516 wrote to memory of 1608 4516 A697.tmp 138 PID 1608 wrote to memory of 4308 1608 A714.tmp 139 PID 4308 wrote to memory of 4568 4308 A791.tmp 140 PID 4568 wrote to memory of 892 4568 A7FE.tmp 141 PID 892 wrote to memory of 4588 892 A87B.tmp 142 PID 4588 wrote to memory of 5364 4588 A8F8.tmp 143 PID 5364 wrote to memory of 4224 5364 A965.tmp 144 PID 4224 wrote to memory of 1828 4224 A9E2.tmp 145 PID 1828 wrote to memory of 940 1828 AA7F.tmp 146 PID 940 wrote to memory of 1740 940 AAFC.tmp 147 PID 1740 wrote to memory of 4604 1740 AB69.tmp 148 PID 4604 wrote to memory of 2472 4604 ABE6.tmp 149 PID 2472 wrote to memory of 5300 2472 AC73.tmp 150 PID 5300 wrote to memory of 5048 5300 ACFF.tmp 151 PID 5048 wrote to memory of 5288 5048 AD6D.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-30_61d2ff8b44db0bb2127281021a00ecdd_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-30_61d2ff8b44db0bb2127281021a00ecdd_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\8802.tmp"C:\Users\Admin\AppData\Local\Temp\8802.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\88BE.tmp"C:\Users\Admin\AppData\Local\Temp\88BE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\892B.tmp"C:\Users\Admin\AppData\Local\Temp\892B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\8A83.tmp"C:\Users\Admin\AppData\Local\Temp\8A83.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\8F36.tmp"C:\Users\Admin\AppData\Local\Temp\8F36.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\9040.tmp"C:\Users\Admin\AppData\Local\Temp\9040.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\910B.tmp"C:\Users\Admin\AppData\Local\Temp\910B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\91A7.tmp"C:\Users\Admin\AppData\Local\Temp\91A7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\9272.tmp"C:\Users\Admin\AppData\Local\Temp\9272.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\92FF.tmp"C:\Users\Admin\AppData\Local\Temp\92FF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\93DA.tmp"C:\Users\Admin\AppData\Local\Temp\93DA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\94A5.tmp"C:\Users\Admin\AppData\Local\Temp\94A5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\9541.tmp"C:\Users\Admin\AppData\Local\Temp\9541.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\963B.tmp"C:\Users\Admin\AppData\Local\Temp\963B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\96D7.tmp"C:\Users\Admin\AppData\Local\Temp\96D7.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\97E1.tmp"C:\Users\Admin\AppData\Local\Temp\97E1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\98AC.tmp"C:\Users\Admin\AppData\Local\Temp\98AC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\9948.tmp"C:\Users\Admin\AppData\Local\Temp\9948.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\9A13.tmp"C:\Users\Admin\AppData\Local\Temp\9A13.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\9C75.tmp"C:\Users\Admin\AppData\Local\Temp\9C75.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\9D40.tmp"C:\Users\Admin\AppData\Local\Temp\9D40.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\9F63.tmp"C:\Users\Admin\AppData\Local\Temp\9F63.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\A03E.tmp"C:\Users\Admin\AppData\Local\Temp\A03E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\A128.tmp"C:\Users\Admin\AppData\Local\Temp\A128.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\A1A5.tmp"C:\Users\Admin\AppData\Local\Temp\A1A5.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\A212.tmp"C:\Users\Admin\AppData\Local\Temp\A212.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\A28F.tmp"C:\Users\Admin\AppData\Local\Temp\A28F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\A31C.tmp"C:\Users\Admin\AppData\Local\Temp\A31C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\A399.tmp"C:\Users\Admin\AppData\Local\Temp\A399.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\A416.tmp"C:\Users\Admin\AppData\Local\Temp\A416.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\A493.tmp"C:\Users\Admin\AppData\Local\Temp\A493.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\A52F.tmp"C:\Users\Admin\AppData\Local\Temp\A52F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\A59D.tmp"C:\Users\Admin\AppData\Local\Temp\A59D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\A61A.tmp"C:\Users\Admin\AppData\Local\Temp\A61A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\A697.tmp"C:\Users\Admin\AppData\Local\Temp\A697.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\A714.tmp"C:\Users\Admin\AppData\Local\Temp\A714.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\A791.tmp"C:\Users\Admin\AppData\Local\Temp\A791.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\A7FE.tmp"C:\Users\Admin\AppData\Local\Temp\A7FE.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\A87B.tmp"C:\Users\Admin\AppData\Local\Temp\A87B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\A965.tmp"C:\Users\Admin\AppData\Local\Temp\A965.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\AAFC.tmp"C:\Users\Admin\AppData\Local\Temp\AAFC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\AB69.tmp"C:\Users\Admin\AppData\Local\Temp\AB69.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\AC73.tmp"C:\Users\Admin\AppData\Local\Temp\AC73.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\AE09.tmp"C:\Users\Admin\AppData\Local\Temp\AE09.tmp"65⤵
- Executes dropped EXE
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\AE95.tmp"C:\Users\Admin\AppData\Local\Temp\AE95.tmp"66⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\AF22.tmp"C:\Users\Admin\AppData\Local\Temp\AF22.tmp"67⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"68⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\B03B.tmp"C:\Users\Admin\AppData\Local\Temp\B03B.tmp"69⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"70⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\B135.tmp"C:\Users\Admin\AppData\Local\Temp\B135.tmp"71⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"72⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"73⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"74⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"75⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"76⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"77⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"78⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\B56B.tmp"C:\Users\Admin\AppData\Local\Temp\B56B.tmp"79⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"80⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\B656.tmp"C:\Users\Admin\AppData\Local\Temp\B656.tmp"81⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"82⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\B750.tmp"C:\Users\Admin\AppData\Local\Temp\B750.tmp"83⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\B84A.tmp"C:\Users\Admin\AppData\Local\Temp\B84A.tmp"85⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"86⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"87⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"88⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"89⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\BACA.tmp"C:\Users\Admin\AppData\Local\Temp\BACA.tmp"90⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\BB57.tmp"C:\Users\Admin\AppData\Local\Temp\BB57.tmp"91⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"92⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\BC61.tmp"C:\Users\Admin\AppData\Local\Temp\BC61.tmp"93⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"94⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"95⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\BE07.tmp"C:\Users\Admin\AppData\Local\Temp\BE07.tmp"96⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\BE93.tmp"C:\Users\Admin\AppData\Local\Temp\BE93.tmp"97⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\BF01.tmp"C:\Users\Admin\AppData\Local\Temp\BF01.tmp"98⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"99⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"100⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\C058.tmp"C:\Users\Admin\AppData\Local\Temp\C058.tmp"101⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"102⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\C152.tmp"C:\Users\Admin\AppData\Local\Temp\C152.tmp"103⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\C1CF.tmp"C:\Users\Admin\AppData\Local\Temp\C1CF.tmp"104⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\C23D.tmp"C:\Users\Admin\AppData\Local\Temp\C23D.tmp"105⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"106⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\C327.tmp"C:\Users\Admin\AppData\Local\Temp\C327.tmp"107⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"108⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\C421.tmp"C:\Users\Admin\AppData\Local\Temp\C421.tmp"109⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\C48E.tmp"C:\Users\Admin\AppData\Local\Temp\C48E.tmp"110⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\C50B.tmp"C:\Users\Admin\AppData\Local\Temp\C50B.tmp"111⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\C588.tmp"C:\Users\Admin\AppData\Local\Temp\C588.tmp"112⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"113⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\C663.tmp"C:\Users\Admin\AppData\Local\Temp\C663.tmp"114⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\C76D.tmp"C:\Users\Admin\AppData\Local\Temp\C76D.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"117⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\C848.tmp"C:\Users\Admin\AppData\Local\Temp\C848.tmp"118⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"119⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\C961.tmp"C:\Users\Admin\AppData\Local\Temp\C961.tmp"120⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"121⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"122⤵PID:1896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-