Analysis
- max time kernel
121s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 15:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-01_1faff42139d4a1a5efcb929902c9712c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-01_1faff42139d4a1a5efcb929902c9712c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-09-01_1faff42139d4a1a5efcb929902c9712c_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260903-sma2fsaa79
- SHA256 f6cb39e8fdad9dfee791c9a01a70dab4886769828316b6c6f90b8d10ff7223ae
- MD5 1faff42139d4a1a5efcb929902c9712c
- SHA1 d12f57e94ed726ec80e11dc1848794f910eb5a1c
- SHA512 6b2b515c653adcf5b81cf9f7928d1fcd695fe80c9ec0232842c15c735aea6362809d09cc1123b16e7684ceae92f9ee2559ac7158ea10414ddabb5b9e77148251
- SSDEEP 12288:HU5rCOTeiJBT3mQT14RHZFuzuhO8jEPSoOXltCa3aNZ:HUQOJJNH+RHizuhOGEPZ0RaN
- TLSH T187B4F020B585C033E69212310AE6EB61693BBD315B22A4C73B94777E6EB43E2D774347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 256 6D56.tmp 3944 6E7F.tmp 2456 6F79.tmp 4340 7006.tmp 4312 7100.tmp 2976 718C.tmp 6004 7277.tmp 4516 73EE.tmp 5412 7517.tmp 2020 75E2.tmp 4456 76AD.tmp 4796 7759.tmp 4240 7834.tmp 5440 793D.tmp 2268 7A28.tmp 5408 7AE3.tmp 4384 7B8F.tmp 5300 7C3B.tmp 1784 7CC7.tmp 5636 7DD1.tmp 2104 7E8D.tmp 2360 7F19.tmp 4940 8004.tmp 2464 80FE.tmp 2904 819A.tmp 6072 8246.tmp 3456 8330.tmp 4328 83DC.tmp 3268 8497.tmp 4268 8543.tmp 5404 85D0.tmp 6140 867C.tmp 2936 8728.tmp 1836 87A5.tmp 1152 8831.tmp 1952 88CE.tmp 2796 8979.tmp 1732 8A25.tmp 2700 8AE1.tmp 2332 8B7D.tmp 4784 8C0A.tmp 5272 8C96.tmp 5916 8D33.tmp 1020 8DCF.tmp 916 8E5B.tmp 4092 8EE8.tmp 1164 8FA4.tmp 2988 9021.tmp 4308 90AD.tmp 872 9169.tmp 4592 9205.tmp 4176 9292.tmp 4220 934D.tmp 5844 93DA.tmp 2468 9495.tmp 2900 9512.tmp 6044 95BE.tmp 2308 964B.tmp 4824 96E7.tmp 1820 9783.tmp 5864 9800.tmp 1640 989C.tmp 1216 9919.tmp 1968 99A6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F860.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1425.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 516D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C44B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D89E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6553.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D306.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C00A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 201C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A25.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1828 wrote to memory of 256 1828 2026-09-01_1faff42139d4a1a5efcb929902c9712c_elex_mafia_stealc_tofsee.exe 89 PID 256 wrote to memory of 3944 256 6D56.tmp 90 PID 3944 wrote to memory of 2456 3944 6E7F.tmp 91 PID 2456 wrote to memory of 4340 2456 6F79.tmp 92 PID 4340 wrote to memory of 4312 4340 7006.tmp 93 PID 4312 wrote to memory of 2976 4312 7100.tmp 94 PID 2976 wrote to memory of 6004 2976 718C.tmp 95 PID 6004 wrote to memory of 4516 6004 7277.tmp 96 PID 4516 wrote to memory of 5412 4516 73EE.tmp 97 PID 5412 wrote to memory of 2020 5412 7517.tmp 98 PID 2020 wrote to memory of 4456 2020 75E2.tmp 99 PID 4456 wrote to memory of 4796 4456 76AD.tmp 100 PID 4796 wrote to memory of 4240 4796 7759.tmp 101 PID 4240 wrote to memory of 5440 4240 7834.tmp 102 PID 5440 wrote to memory of 2268 5440 793D.tmp 103 PID 2268 wrote to memory of 5408 2268 7A28.tmp 104 PID 5408 wrote to memory of 4384 5408 7AE3.tmp 105 PID 4384 wrote to memory of 5300 4384 7B8F.tmp 106 PID 5300 wrote to memory of 1784 5300 7C3B.tmp 107 PID 1784 wrote to memory of 5636 1784 7CC7.tmp 108 PID 5636 wrote to memory of 2104 5636 7DD1.tmp 109 PID 2104 wrote to memory of 2360 2104 7E8D.tmp 110 PID 2360 wrote to memory of 4940 2360 7F19.tmp 111 PID 4940 wrote to memory of 2464 4940 8004.tmp 112 PID 2464 wrote to memory of 2904 2464 80FE.tmp 113 PID 2904 wrote to memory of 6072 2904 819A.tmp 114 PID 6072 wrote to memory of 3456 6072 8246.tmp 115 PID 3456 wrote to memory of 4328 3456 8330.tmp 116 PID 4328 wrote to memory of 3268 4328 83DC.tmp 117 PID 3268 wrote to memory of 4268 3268 8497.tmp 118 PID 4268 wrote to memory of 5404 4268 8543.tmp 119 PID 5404 wrote to memory of 6140 5404 85D0.tmp 120 PID 6140 wrote to memory of 2936 6140 867C.tmp 121 PID 2936 wrote to memory of 1836 2936 8728.tmp 122 PID 1836 wrote to memory of 1152 1836 87A5.tmp 123 PID 1152 wrote to memory of 1952 1152 8831.tmp 124 PID 1952 wrote to memory of 2796 1952 88CE.tmp 125 PID 2796 wrote to memory of 1732 2796 8979.tmp 126 PID 1732 wrote to memory of 2700 1732 8A25.tmp 127 PID 2700 wrote to memory of 2332 2700 8AE1.tmp 128 PID 2332 wrote to memory of 4784 2332 8B7D.tmp 129 PID 4784 wrote to memory of 5272 4784 8C0A.tmp 130 PID 5272 wrote to memory of 5916 5272 8C96.tmp 131 PID 5916 wrote to memory of 1020 5916 8D33.tmp 132 PID 1020 wrote to memory of 916 1020 8DCF.tmp 133 PID 916 wrote to memory of 4092 916 8E5B.tmp 134 PID 4092 wrote to memory of 1164 4092 8EE8.tmp 135 PID 1164 wrote to memory of 2988 1164 8FA4.tmp 136 PID 2988 wrote to memory of 4308 2988 9021.tmp 137 PID 4308 wrote to memory of 872 4308 90AD.tmp 138 PID 872 wrote to memory of 4592 872 9169.tmp 139 PID 4592 wrote to memory of 4176 4592 9205.tmp 140 PID 4176 wrote to memory of 4220 4176 9292.tmp 141 PID 4220 wrote to memory of 5844 4220 934D.tmp 142 PID 5844 wrote to memory of 2468 5844 93DA.tmp 143 PID 2468 wrote to memory of 2900 2468 9495.tmp 144 PID 2900 wrote to memory of 6044 2900 9512.tmp 145 PID 6044 wrote to memory of 2308 6044 95BE.tmp 146 PID 2308 wrote to memory of 4824 2308 964B.tmp 147 PID 4824 wrote to memory of 1820 4824 96E7.tmp 148 PID 1820 wrote to memory of 5864 1820 9783.tmp 149 PID 5864 wrote to memory of 1640 5864 9800.tmp 150 PID 1640 wrote to memory of 1216 1640 989C.tmp 151 PID 1216 wrote to memory of 1968 1216 9919.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-01_1faff42139d4a1a5efcb929902c9712c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_1faff42139d4a1a5efcb929902c9712c_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\6D56.tmp"C:\Users\Admin\AppData\Local\Temp\6D56.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\6F79.tmp"C:\Users\Admin\AppData\Local\Temp\6F79.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\7006.tmp"C:\Users\Admin\AppData\Local\Temp\7006.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7100.tmp"C:\Users\Admin\AppData\Local\Temp\7100.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\718C.tmp"C:\Users\Admin\AppData\Local\Temp\718C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\7277.tmp"C:\Users\Admin\AppData\Local\Temp\7277.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\73EE.tmp"C:\Users\Admin\AppData\Local\Temp\73EE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\7517.tmp"C:\Users\Admin\AppData\Local\Temp\7517.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\75E2.tmp"C:\Users\Admin\AppData\Local\Temp\75E2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\76AD.tmp"C:\Users\Admin\AppData\Local\Temp\76AD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\7759.tmp"C:\Users\Admin\AppData\Local\Temp\7759.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\7834.tmp"C:\Users\Admin\AppData\Local\Temp\7834.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\793D.tmp"C:\Users\Admin\AppData\Local\Temp\793D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\7A28.tmp"C:\Users\Admin\AppData\Local\Temp\7A28.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\7AE3.tmp"C:\Users\Admin\AppData\Local\Temp\7AE3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\7B8F.tmp"C:\Users\Admin\AppData\Local\Temp\7B8F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\7F19.tmp"C:\Users\Admin\AppData\Local\Temp\7F19.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\8004.tmp"C:\Users\Admin\AppData\Local\Temp\8004.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\80FE.tmp"C:\Users\Admin\AppData\Local\Temp\80FE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\819A.tmp"C:\Users\Admin\AppData\Local\Temp\819A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\8246.tmp"C:\Users\Admin\AppData\Local\Temp\8246.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\8330.tmp"C:\Users\Admin\AppData\Local\Temp\8330.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\83DC.tmp"C:\Users\Admin\AppData\Local\Temp\83DC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\8497.tmp"C:\Users\Admin\AppData\Local\Temp\8497.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\85D0.tmp"C:\Users\Admin\AppData\Local\Temp\85D0.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\867C.tmp"C:\Users\Admin\AppData\Local\Temp\867C.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\8728.tmp"C:\Users\Admin\AppData\Local\Temp\8728.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\87A5.tmp"C:\Users\Admin\AppData\Local\Temp\87A5.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\8831.tmp"C:\Users\Admin\AppData\Local\Temp\8831.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\88CE.tmp"C:\Users\Admin\AppData\Local\Temp\88CE.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\8979.tmp"C:\Users\Admin\AppData\Local\Temp\8979.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\8A25.tmp"C:\Users\Admin\AppData\Local\Temp\8A25.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\8D33.tmp"C:\Users\Admin\AppData\Local\Temp\8D33.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\8FA4.tmp"C:\Users\Admin\AppData\Local\Temp\8FA4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\9021.tmp"C:\Users\Admin\AppData\Local\Temp\9021.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\90AD.tmp"C:\Users\Admin\AppData\Local\Temp\90AD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\9169.tmp"C:\Users\Admin\AppData\Local\Temp\9169.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\9205.tmp"C:\Users\Admin\AppData\Local\Temp\9205.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\9292.tmp"C:\Users\Admin\AppData\Local\Temp\9292.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\934D.tmp"C:\Users\Admin\AppData\Local\Temp\934D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\93DA.tmp"C:\Users\Admin\AppData\Local\Temp\93DA.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\9495.tmp"C:\Users\Admin\AppData\Local\Temp\9495.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\9512.tmp"C:\Users\Admin\AppData\Local\Temp\9512.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\964B.tmp"C:\Users\Admin\AppData\Local\Temp\964B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\96E7.tmp"C:\Users\Admin\AppData\Local\Temp\96E7.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\9783.tmp"C:\Users\Admin\AppData\Local\Temp\9783.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\9800.tmp"C:\Users\Admin\AppData\Local\Temp\9800.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\989C.tmp"C:\Users\Admin\AppData\Local\Temp\989C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\9919.tmp"C:\Users\Admin\AppData\Local\Temp\9919.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\99A6.tmp"C:\Users\Admin\AppData\Local\Temp\99A6.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"66⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"67⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\9B7B.tmp"C:\Users\Admin\AppData\Local\Temp\9B7B.tmp"68⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"69⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\9C84.tmp"C:\Users\Admin\AppData\Local\Temp\9C84.tmp"70⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\9D11.tmp"C:\Users\Admin\AppData\Local\Temp\9D11.tmp"71⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"72⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"73⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\9F24.tmp"C:\Users\Admin\AppData\Local\Temp\9F24.tmp"75⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"76⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\A03E.tmp"C:\Users\Admin\AppData\Local\Temp\A03E.tmp"77⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"78⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\A166.tmp"C:\Users\Admin\AppData\Local\Temp\A166.tmp"79⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"80⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\A270.tmp"C:\Users\Admin\AppData\Local\Temp\A270.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\A30C.tmp"C:\Users\Admin\AppData\Local\Temp\A30C.tmp"82⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\A399.tmp"C:\Users\Admin\AppData\Local\Temp\A399.tmp"83⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\A406.tmp"C:\Users\Admin\AppData\Local\Temp\A406.tmp"84⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\A483.tmp"C:\Users\Admin\AppData\Local\Temp\A483.tmp"85⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\A510.tmp"C:\Users\Admin\AppData\Local\Temp\A510.tmp"86⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\A59D.tmp"C:\Users\Admin\AppData\Local\Temp\A59D.tmp"87⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\A60A.tmp"C:\Users\Admin\AppData\Local\Temp\A60A.tmp"88⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\A697.tmp"C:\Users\Admin\AppData\Local\Temp\A697.tmp"89⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\A723.tmp"C:\Users\Admin\AppData\Local\Temp\A723.tmp"90⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"91⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\A85C.tmp"C:\Users\Admin\AppData\Local\Temp\A85C.tmp"92⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\A8D9.tmp"C:\Users\Admin\AppData\Local\Temp\A8D9.tmp"93⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\A965.tmp"C:\Users\Admin\AppData\Local\Temp\A965.tmp"94⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"95⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"96⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"97⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\AB59.tmp"C:\Users\Admin\AppData\Local\Temp\AB59.tmp"98⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"99⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\AC82.tmp"C:\Users\Admin\AppData\Local\Temp\AC82.tmp"100⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"101⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\AD7C.tmp"C:\Users\Admin\AppData\Local\Temp\AD7C.tmp"102⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\AE47.tmp"C:\Users\Admin\AppData\Local\Temp\AE47.tmp"103⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\AED4.tmp"C:\Users\Admin\AppData\Local\Temp\AED4.tmp"104⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\AF41.tmp"C:\Users\Admin\AppData\Local\Temp\AF41.tmp"105⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"106⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\B02C.tmp"C:\Users\Admin\AppData\Local\Temp\B02C.tmp"107⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"108⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\B135.tmp"C:\Users\Admin\AppData\Local\Temp\B135.tmp"109⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"110⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"111⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"112⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"113⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"114⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\B452.tmp"C:\Users\Admin\AppData\Local\Temp\B452.tmp"115⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\B50E.tmp"C:\Users\Admin\AppData\Local\Temp\B50E.tmp"116⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"117⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\B627.tmp"C:\Users\Admin\AppData\Local\Temp\B627.tmp"118⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"119⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\B750.tmp"C:\Users\Admin\AppData\Local\Temp\B750.tmp"120⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"121⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B82B.tmp"C:\Users\Admin\AppData\Local\Temp\B82B.tmp"122⤵PID:5460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-