Analysis
- max time kernel
115s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260930-lecfzsts2p
- SHA256 c206b9d10cb588e0adb1e45355f25370844de7b0ec9b6a11fe01460b53a6d987
- MD5 9645d0e97c77a9641fc4f70d8d138147
- SHA1 689730bb1ef54dc76201ff713d99554e04b6a99d
- SHA512 8f7a3a962d3c941aa6538c708df7ec6d0cc6f9286b2aea61a8005135503e5f9e44a303b52c8637e2b9d7d08e99142f93b36abe90d15f0450ae914c7213c01adb
- SSDEEP 12288:NU5rCOTeijWIbDoN3qlBz4XfkgAnkmP7QTZwlH4Hp:NUQOJjWQDowQXcgAzzQTSlH4Hp
- TLSH T1C9B4F126B644C132E6D202710AE6DBE26A3FBC34572694C73B94623D2FB66E1D335347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2876 428.tmp 4088 502.tmp 1372 60C.tmp 1148 725.tmp 5796 7F0.tmp 3916 90A.tmp 5256 AA0.tmp 2380 BAA.tmp 3824 CA4.tmp 4252 D21.tmp 3712 DEC.tmp 3240 EC6.tmp 4372 FA1.tmp 4944 104D.tmp 3948 1157.tmp 2824 11F3.tmp 2364 12AE.tmp 5696 13B8.tmp 2972 1493.tmp 6116 154E.tmp 3128 160A.tmp 2000 16F4.tmp 2648 17EE.tmp 4124 18F8.tmp 476 19B3.tmp 1652 1A7E.tmp 3304 1B2A.tmp 3800 1BB7.tmp 3496 1C63.tmp 2756 1D2E.tmp 4136 1E09.tmp 1544 1EE3.tmp 3336 1FAF.tmp 2872 204B.tmp 2248 20D7.tmp 5980 2145.tmp 3064 21F1.tmp 904 226E.tmp 2116 231A.tmp 5996 23A6.tmp 2420 2433.tmp 6008 24B0.tmp 4784 254C.tmp 3328 25E8.tmp 200 2694.tmp 2976 2730.tmp 5604 27BD.tmp 1480 283A.tmp 812 28C7.tmp 2980 2973.tmp 4692 2A0F.tmp 5840 2AAB.tmp 5152 2B38.tmp 2544 2BD4.tmp 3176 2C8F.tmp 3372 2CFD.tmp 5420 2D7A.tmp 1796 2DF7.tmp 3024 2E83.tmp 1324 2F10.tmp 1608 2F9D.tmp 1748 3029.tmp 1708 30D5.tmp 424 3143.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 616B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E168.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 410D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7972.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E58F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3143.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A545.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D293.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E76.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3392 wrote to memory of 2876 3392 2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe 88 PID 2876 wrote to memory of 4088 2876 428.tmp 89 PID 4088 wrote to memory of 1372 4088 502.tmp 90 PID 1372 wrote to memory of 1148 1372 60C.tmp 91 PID 1148 wrote to memory of 5796 1148 725.tmp 92 PID 5796 wrote to memory of 3916 5796 7F0.tmp 93 PID 3916 wrote to memory of 5256 3916 90A.tmp 94 PID 5256 wrote to memory of 2380 5256 AA0.tmp 95 PID 2380 wrote to memory of 3824 2380 BAA.tmp 96 PID 3824 wrote to memory of 4252 3824 CA4.tmp 97 PID 4252 wrote to memory of 3712 4252 D21.tmp 98 PID 3712 wrote to memory of 3240 3712 DEC.tmp 99 PID 3240 wrote to memory of 4372 3240 EC6.tmp 100 PID 4372 wrote to memory of 4944 4372 FA1.tmp 101 PID 4944 wrote to memory of 3948 4944 104D.tmp 102 PID 3948 wrote to memory of 2824 3948 1157.tmp 103 PID 2824 wrote to memory of 2364 2824 11F3.tmp 104 PID 2364 wrote to memory of 5696 2364 12AE.tmp 105 PID 5696 wrote to memory of 2972 5696 13B8.tmp 106 PID 2972 wrote to memory of 6116 2972 1493.tmp 107 PID 6116 wrote to memory of 3128 6116 154E.tmp 108 PID 3128 wrote to memory of 2000 3128 160A.tmp 109 PID 2000 wrote to memory of 2648 2000 16F4.tmp 110 PID 2648 wrote to memory of 4124 2648 17EE.tmp 111 PID 4124 wrote to memory of 476 4124 18F8.tmp 112 PID 476 wrote to memory of 1652 476 19B3.tmp 113 PID 1652 wrote to memory of 3304 1652 1A7E.tmp 114 PID 3304 wrote to memory of 3800 3304 1B2A.tmp 115 PID 3800 wrote to memory of 3496 3800 1BB7.tmp 116 PID 3496 wrote to memory of 2756 3496 1C63.tmp 117 PID 2756 wrote to memory of 4136 2756 1D2E.tmp 118 PID 4136 wrote to memory of 1544 4136 1E09.tmp 119 PID 1544 wrote to memory of 3336 1544 1EE3.tmp 120 PID 3336 wrote to memory of 2872 3336 1FAF.tmp 121 PID 2872 wrote to memory of 2248 2872 204B.tmp 122 PID 2248 wrote to memory of 5980 2248 20D7.tmp 123 PID 5980 wrote to memory of 3064 5980 2145.tmp 124 PID 3064 wrote to memory of 904 3064 21F1.tmp 125 PID 904 wrote to memory of 2116 904 226E.tmp 126 PID 2116 wrote to memory of 5996 2116 231A.tmp 127 PID 5996 wrote to memory of 2420 5996 23A6.tmp 128 PID 2420 wrote to memory of 6008 2420 2433.tmp 129 PID 6008 wrote to memory of 4784 6008 24B0.tmp 130 PID 4784 wrote to memory of 3328 4784 254C.tmp 131 PID 3328 wrote to memory of 200 3328 25E8.tmp 132 PID 200 wrote to memory of 2976 200 2694.tmp 133 PID 2976 wrote to memory of 5604 2976 2730.tmp 134 PID 5604 wrote to memory of 1480 5604 27BD.tmp 135 PID 1480 wrote to memory of 812 1480 283A.tmp 136 PID 812 wrote to memory of 2980 812 28C7.tmp 137 PID 2980 wrote to memory of 4692 2980 2973.tmp 138 PID 4692 wrote to memory of 5840 4692 2A0F.tmp 139 PID 5840 wrote to memory of 5152 5840 2AAB.tmp 140 PID 5152 wrote to memory of 2544 5152 2B38.tmp 141 PID 2544 wrote to memory of 3176 2544 2BD4.tmp 142 PID 3176 wrote to memory of 3372 3176 2C8F.tmp 143 PID 3372 wrote to memory of 5420 3372 2CFD.tmp 144 PID 5420 wrote to memory of 1796 5420 2D7A.tmp 145 PID 1796 wrote to memory of 3024 1796 2DF7.tmp 146 PID 3024 wrote to memory of 1324 3024 2E83.tmp 147 PID 1324 wrote to memory of 1608 1324 2F10.tmp 148 PID 1608 wrote to memory of 1748 1608 2F9D.tmp 149 PID 1748 wrote to memory of 1708 1748 3029.tmp 150 PID 1708 wrote to memory of 424 1708 30D5.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\428.tmp"C:\Users\Admin\AppData\Local\Temp\428.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\502.tmp"C:\Users\Admin\AppData\Local\Temp\502.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\60C.tmp"C:\Users\Admin\AppData\Local\Temp\60C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\725.tmp"C:\Users\Admin\AppData\Local\Temp\725.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\7F0.tmp"C:\Users\Admin\AppData\Local\Temp\7F0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\90A.tmp"C:\Users\Admin\AppData\Local\Temp\90A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\AA0.tmp"C:\Users\Admin\AppData\Local\Temp\AA0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\BAA.tmp"C:\Users\Admin\AppData\Local\Temp\BAA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\CA4.tmp"C:\Users\Admin\AppData\Local\Temp\CA4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\D21.tmp"C:\Users\Admin\AppData\Local\Temp\D21.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\DEC.tmp"C:\Users\Admin\AppData\Local\Temp\DEC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\EC6.tmp"C:\Users\Admin\AppData\Local\Temp\EC6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\FA1.tmp"C:\Users\Admin\AppData\Local\Temp\FA1.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\104D.tmp"C:\Users\Admin\AppData\Local\Temp\104D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\1157.tmp"C:\Users\Admin\AppData\Local\Temp\1157.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\11F3.tmp"C:\Users\Admin\AppData\Local\Temp\11F3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\12AE.tmp"C:\Users\Admin\AppData\Local\Temp\12AE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\13B8.tmp"C:\Users\Admin\AppData\Local\Temp\13B8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\1493.tmp"C:\Users\Admin\AppData\Local\Temp\1493.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\154E.tmp"C:\Users\Admin\AppData\Local\Temp\154E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\160A.tmp"C:\Users\Admin\AppData\Local\Temp\160A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\16F4.tmp"C:\Users\Admin\AppData\Local\Temp\16F4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\17EE.tmp"C:\Users\Admin\AppData\Local\Temp\17EE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\18F8.tmp"C:\Users\Admin\AppData\Local\Temp\18F8.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\19B3.tmp"C:\Users\Admin\AppData\Local\Temp\19B3.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\1BB7.tmp"C:\Users\Admin\AppData\Local\Temp\1BB7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\1C63.tmp"C:\Users\Admin\AppData\Local\Temp\1C63.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\1E09.tmp"C:\Users\Admin\AppData\Local\Temp\1E09.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\204B.tmp"C:\Users\Admin\AppData\Local\Temp\204B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\2145.tmp"C:\Users\Admin\AppData\Local\Temp\2145.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\21F1.tmp"C:\Users\Admin\AppData\Local\Temp\21F1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\226E.tmp"C:\Users\Admin\AppData\Local\Temp\226E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\23A6.tmp"C:\Users\Admin\AppData\Local\Temp\23A6.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\27BD.tmp"C:\Users\Admin\AppData\Local\Temp\27BD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\283A.tmp"C:\Users\Admin\AppData\Local\Temp\283A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\28C7.tmp"C:\Users\Admin\AppData\Local\Temp\28C7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\2973.tmp"C:\Users\Admin\AppData\Local\Temp\2973.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\2B38.tmp"C:\Users\Admin\AppData\Local\Temp\2B38.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\2C8F.tmp"C:\Users\Admin\AppData\Local\Temp\2C8F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\2CFD.tmp"C:\Users\Admin\AppData\Local\Temp\2CFD.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\2DF7.tmp"C:\Users\Admin\AppData\Local\Temp\2DF7.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\2E83.tmp"C:\Users\Admin\AppData\Local\Temp\2E83.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2F10.tmp"C:\Users\Admin\AppData\Local\Temp\2F10.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3029.tmp"C:\Users\Admin\AppData\Local\Temp\3029.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\30D5.tmp"C:\Users\Admin\AppData\Local\Temp\30D5.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3143.tmp"C:\Users\Admin\AppData\Local\Temp\3143.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:424 -
C:\Users\Admin\AppData\Local\Temp\31CF.tmp"C:\Users\Admin\AppData\Local\Temp\31CF.tmp"66⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\328B.tmp"C:\Users\Admin\AppData\Local\Temp\328B.tmp"67⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\3356.tmp"C:\Users\Admin\AppData\Local\Temp\3356.tmp"68⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3402.tmp"C:\Users\Admin\AppData\Local\Temp\3402.tmp"69⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\347F.tmp"C:\Users\Admin\AppData\Local\Temp\347F.tmp"70⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\351B.tmp"C:\Users\Admin\AppData\Local\Temp\351B.tmp"71⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\35B7.tmp"C:\Users\Admin\AppData\Local\Temp\35B7.tmp"72⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\3634.tmp"C:\Users\Admin\AppData\Local\Temp\3634.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\36C1.tmp"C:\Users\Admin\AppData\Local\Temp\36C1.tmp"74⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\374D.tmp"C:\Users\Admin\AppData\Local\Temp\374D.tmp"75⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\37DA.tmp"C:\Users\Admin\AppData\Local\Temp\37DA.tmp"76⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\3867.tmp"C:\Users\Admin\AppData\Local\Temp\3867.tmp"77⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\38F3.tmp"C:\Users\Admin\AppData\Local\Temp\38F3.tmp"78⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\3980.tmp"C:\Users\Admin\AppData\Local\Temp\3980.tmp"79⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\3A2C.tmp"C:\Users\Admin\AppData\Local\Temp\3A2C.tmp"80⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\3A99.tmp"C:\Users\Admin\AppData\Local\Temp\3A99.tmp"81⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\3B35.tmp"C:\Users\Admin\AppData\Local\Temp\3B35.tmp"82⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\3BC2.tmp"C:\Users\Admin\AppData\Local\Temp\3BC2.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\3C5E.tmp"C:\Users\Admin\AppData\Local\Temp\3C5E.tmp"84⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\3CCC.tmp"C:\Users\Admin\AppData\Local\Temp\3CCC.tmp"85⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\3D58.tmp"C:\Users\Admin\AppData\Local\Temp\3D58.tmp"86⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\3DD5.tmp"C:\Users\Admin\AppData\Local\Temp\3DD5.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\3E43.tmp"C:\Users\Admin\AppData\Local\Temp\3E43.tmp"88⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\3ECF.tmp"C:\Users\Admin\AppData\Local\Temp\3ECF.tmp"89⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\3F5C.tmp"C:\Users\Admin\AppData\Local\Temp\3F5C.tmp"90⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\3FF8.tmp"C:\Users\Admin\AppData\Local\Temp\3FF8.tmp"91⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\4075.tmp"C:\Users\Admin\AppData\Local\Temp\4075.tmp"92⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\4102.tmp"C:\Users\Admin\AppData\Local\Temp\4102.tmp"93⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\419E.tmp"C:\Users\Admin\AppData\Local\Temp\419E.tmp"94⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\423A.tmp"C:\Users\Admin\AppData\Local\Temp\423A.tmp"95⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\42E6.tmp"C:\Users\Admin\AppData\Local\Temp\42E6.tmp"96⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\4373.tmp"C:\Users\Admin\AppData\Local\Temp\4373.tmp"97⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\441F.tmp"C:\Users\Admin\AppData\Local\Temp\441F.tmp"98⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\44BB.tmp"C:\Users\Admin\AppData\Local\Temp\44BB.tmp"99⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\4538.tmp"C:\Users\Admin\AppData\Local\Temp\4538.tmp"100⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\45C5.tmp"C:\Users\Admin\AppData\Local\Temp\45C5.tmp"101⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\4661.tmp"C:\Users\Admin\AppData\Local\Temp\4661.tmp"102⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\46CE.tmp"C:\Users\Admin\AppData\Local\Temp\46CE.tmp"103⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\476A.tmp"C:\Users\Admin\AppData\Local\Temp\476A.tmp"104⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\47F7.tmp"C:\Users\Admin\AppData\Local\Temp\47F7.tmp"105⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\4884.tmp"C:\Users\Admin\AppData\Local\Temp\4884.tmp"106⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\4901.tmp"C:\Users\Admin\AppData\Local\Temp\4901.tmp"107⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\499D.tmp"C:\Users\Admin\AppData\Local\Temp\499D.tmp"108⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"109⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"110⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"111⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"112⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"113⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"114⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\4D37.tmp"C:\Users\Admin\AppData\Local\Temp\4D37.tmp"115⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\4DB4.tmp"C:\Users\Admin\AppData\Local\Temp\4DB4.tmp"116⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\4E31.tmp"C:\Users\Admin\AppData\Local\Temp\4E31.tmp"117⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\4EBD.tmp"C:\Users\Admin\AppData\Local\Temp\4EBD.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4F2B.tmp"C:\Users\Admin\AppData\Local\Temp\4F2B.tmp"119⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\4FA8.tmp"C:\Users\Admin\AppData\Local\Temp\4FA8.tmp"120⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\5025.tmp"C:\Users\Admin\AppData\Local\Temp\5025.tmp"121⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\50A2.tmp"C:\Users\Admin\AppData\Local\Temp\50A2.tmp"122⤵PID:1100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-