Analysis
- max time kernel
99s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_3ae8ccaf33a70f64474c289b26cdbde2_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_3ae8ccaf33a70f64474c289b26cdbde2_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-30_3ae8ccaf33a70f64474c289b26cdbde2_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260930-pfdbfst1g1
- SHA256 d61aa7260bb2ed1d3de6104af26fc948cb0ab01e02b1d7d8dc9d26fb7d4b5ab8
- MD5 3ae8ccaf33a70f64474c289b26cdbde2
- SHA1 9940c5e620cbab2ddf0eefe9d6afc71ed1aed74c
- SHA512 e5d73ba772a2b6858e1aab2f1b5fb6f877c0342a8cbaa6158e3fe9004a03bdb8346cd7654cb5710d387fc69cc55e38c591442cceffd0913af6e0427bb64d4551
- SSDEEP 12288:9U5rCOTei6MZKiPMr5J1KoAv3knMJbqZoXWjdq:9UQOJ6JiPKKXsnMJbqqGh
- TLSH T139C4F125B688C032E59212350EE6EBA1597EBC75972294C72BC0B77E2FB52E18274347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2820 62C2.tmp 2140 636E.tmp 4176 6449.tmp 4820 6524.tmp 4716 65DF.tmp 5780 6AC1.tmp 5988 6B6D.tmp 4388 6C09.tmp 3712 6CF4.tmp 3940 6DA0.tmp 3036 6E2C.tmp 4364 6EB9.tmp 3080 6F74.tmp 1092 7020.tmp 5456 70CC.tmp 4920 7188.tmp 4796 7234.tmp 5152 72FF.tmp 5172 737C.tmp 948 73F9.tmp 5176 7476.tmp 2184 7512.tmp 1348 75BE.tmp 3968 766A.tmp 2832 7725.tmp 4540 77F0.tmp 3128 788D.tmp 1384 7967.tmp 2540 79F4.tmp 452 7AA0.tmp 1044 7B2C.tmp 1100 7BD8.tmp 1444 7CA3.tmp 4416 7D20.tmp 2068 7D9D.tmp 6016 7E0B.tmp 1276 7E78.tmp 6024 7F05.tmp 5860 7F91.tmp 6004 7FFF.tmp 5128 805D.tmp 5264 80DA.tmp 3028 8166.tmp 1136 81F3.tmp 2324 8270.tmp 4928 82FC.tmp 4380 835A.tmp 2600 83E7.tmp 864 8454.tmp 1532 84F0.tmp 5524 857D.tmp 6048 8629.tmp 3504 86A6.tmp 1356 8723.tmp 3048 8781.tmp 904 880D.tmp 6072 886B.tmp 3032 88E8.tmp 3092 8984.tmp 4216 8A11.tmp 4876 8A7E.tmp 2408 8AEC.tmp 2556 8B69.tmp 5744 8BE6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 857D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9595.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 737C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A98F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D11C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 942E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 915F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F04D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9972.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_3ae8ccaf33a70f64474c289b26cdbde2_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8984.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C39B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A22D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1941.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 634A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F250.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BA7.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2564 wrote to memory of 2820 2564 2026-09-30_3ae8ccaf33a70f64474c289b26cdbde2_elex_mafia_stealc_tofsee.exe 89 PID 2820 wrote to memory of 2140 2820 62C2.tmp 90 PID 2140 wrote to memory of 4176 2140 636E.tmp 91 PID 4176 wrote to memory of 4820 4176 6449.tmp 92 PID 4820 wrote to memory of 4716 4820 6524.tmp 93 PID 4716 wrote to memory of 5780 4716 65DF.tmp 94 PID 5780 wrote to memory of 5988 5780 6AC1.tmp 95 PID 5988 wrote to memory of 4388 5988 6B6D.tmp 96 PID 4388 wrote to memory of 3712 4388 6C09.tmp 97 PID 3712 wrote to memory of 3940 3712 6CF4.tmp 98 PID 3940 wrote to memory of 3036 3940 6DA0.tmp 99 PID 3036 wrote to memory of 4364 3036 6E2C.tmp 100 PID 4364 wrote to memory of 3080 4364 6EB9.tmp 101 PID 3080 wrote to memory of 1092 3080 6F74.tmp 102 PID 1092 wrote to memory of 5456 1092 7020.tmp 103 PID 5456 wrote to memory of 4920 5456 70CC.tmp 104 PID 4920 wrote to memory of 4796 4920 7188.tmp 105 PID 4796 wrote to memory of 5152 4796 7234.tmp 106 PID 5152 wrote to memory of 5172 5152 72FF.tmp 107 PID 5172 wrote to memory of 948 5172 737C.tmp 108 PID 948 wrote to memory of 5176 948 73F9.tmp 109 PID 5176 wrote to memory of 2184 5176 7476.tmp 110 PID 2184 wrote to memory of 1348 2184 7512.tmp 111 PID 1348 wrote to memory of 3968 1348 75BE.tmp 112 PID 3968 wrote to memory of 2832 3968 766A.tmp 113 PID 2832 wrote to memory of 4540 2832 7725.tmp 114 PID 4540 wrote to memory of 3128 4540 77F0.tmp 115 PID 3128 wrote to memory of 1384 3128 788D.tmp 116 PID 1384 wrote to memory of 2540 1384 7967.tmp 117 PID 2540 wrote to memory of 452 2540 79F4.tmp 118 PID 452 wrote to memory of 1044 452 7AA0.tmp 119 PID 1044 wrote to memory of 1100 1044 7B2C.tmp 120 PID 1100 wrote to memory of 1444 1100 7BD8.tmp 121 PID 1444 wrote to memory of 4416 1444 7CA3.tmp 122 PID 4416 wrote to memory of 2068 4416 7D20.tmp 123 PID 2068 wrote to memory of 6016 2068 7D9D.tmp 124 PID 6016 wrote to memory of 1276 6016 7E0B.tmp 125 PID 1276 wrote to memory of 6024 1276 7E78.tmp 126 PID 6024 wrote to memory of 5860 6024 7F05.tmp 127 PID 5860 wrote to memory of 6004 5860 7F91.tmp 128 PID 6004 wrote to memory of 5128 6004 7FFF.tmp 129 PID 5128 wrote to memory of 5264 5128 805D.tmp 130 PID 5264 wrote to memory of 3028 5264 80DA.tmp 131 PID 3028 wrote to memory of 1136 3028 8166.tmp 132 PID 1136 wrote to memory of 2324 1136 81F3.tmp 133 PID 2324 wrote to memory of 4928 2324 8270.tmp 134 PID 4928 wrote to memory of 4380 4928 82FC.tmp 135 PID 4380 wrote to memory of 2600 4380 835A.tmp 136 PID 2600 wrote to memory of 864 2600 83E7.tmp 137 PID 864 wrote to memory of 1532 864 8454.tmp 138 PID 1532 wrote to memory of 5524 1532 84F0.tmp 139 PID 5524 wrote to memory of 6048 5524 857D.tmp 140 PID 6048 wrote to memory of 3504 6048 8629.tmp 141 PID 3504 wrote to memory of 1356 3504 86A6.tmp 142 PID 1356 wrote to memory of 3048 1356 8723.tmp 143 PID 3048 wrote to memory of 904 3048 8781.tmp 144 PID 904 wrote to memory of 6072 904 880D.tmp 145 PID 6072 wrote to memory of 3032 6072 886B.tmp 146 PID 3032 wrote to memory of 3092 3032 88E8.tmp 147 PID 3092 wrote to memory of 4216 3092 8984.tmp 148 PID 4216 wrote to memory of 4876 4216 8A11.tmp 149 PID 4876 wrote to memory of 2408 4876 8A7E.tmp 150 PID 2408 wrote to memory of 2556 2408 8AEC.tmp 151 PID 2556 wrote to memory of 5744 2556 8B69.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_3ae8ccaf33a70f64474c289b26cdbde2_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_3ae8ccaf33a70f64474c289b26cdbde2_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\62C2.tmp"C:\Users\Admin\AppData\Local\Temp\62C2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\636E.tmp"C:\Users\Admin\AppData\Local\Temp\636E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\6449.tmp"C:\Users\Admin\AppData\Local\Temp\6449.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\6524.tmp"C:\Users\Admin\AppData\Local\Temp\6524.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\65DF.tmp"C:\Users\Admin\AppData\Local\Temp\65DF.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\6AC1.tmp"C:\Users\Admin\AppData\Local\Temp\6AC1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\6B6D.tmp"C:\Users\Admin\AppData\Local\Temp\6B6D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\6C09.tmp"C:\Users\Admin\AppData\Local\Temp\6C09.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\6CF4.tmp"C:\Users\Admin\AppData\Local\Temp\6CF4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\6E2C.tmp"C:\Users\Admin\AppData\Local\Temp\6E2C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\6F74.tmp"C:\Users\Admin\AppData\Local\Temp\6F74.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\7020.tmp"C:\Users\Admin\AppData\Local\Temp\7020.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\70CC.tmp"C:\Users\Admin\AppData\Local\Temp\70CC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\7234.tmp"C:\Users\Admin\AppData\Local\Temp\7234.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\72FF.tmp"C:\Users\Admin\AppData\Local\Temp\72FF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\737C.tmp"C:\Users\Admin\AppData\Local\Temp\737C.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\73F9.tmp"C:\Users\Admin\AppData\Local\Temp\73F9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\7476.tmp"C:\Users\Admin\AppData\Local\Temp\7476.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\7512.tmp"C:\Users\Admin\AppData\Local\Temp\7512.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\75BE.tmp"C:\Users\Admin\AppData\Local\Temp\75BE.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\766A.tmp"C:\Users\Admin\AppData\Local\Temp\766A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\7725.tmp"C:\Users\Admin\AppData\Local\Temp\7725.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\77F0.tmp"C:\Users\Admin\AppData\Local\Temp\77F0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\788D.tmp"C:\Users\Admin\AppData\Local\Temp\788D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\7967.tmp"C:\Users\Admin\AppData\Local\Temp\7967.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\79F4.tmp"C:\Users\Admin\AppData\Local\Temp\79F4.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\7B2C.tmp"C:\Users\Admin\AppData\Local\Temp\7B2C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\7BD8.tmp"C:\Users\Admin\AppData\Local\Temp\7BD8.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\7CA3.tmp"C:\Users\Admin\AppData\Local\Temp\7CA3.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\7D20.tmp"C:\Users\Admin\AppData\Local\Temp\7D20.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\7D9D.tmp"C:\Users\Admin\AppData\Local\Temp\7D9D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\7E0B.tmp"C:\Users\Admin\AppData\Local\Temp\7E0B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\7E78.tmp"C:\Users\Admin\AppData\Local\Temp\7E78.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\7F05.tmp"C:\Users\Admin\AppData\Local\Temp\7F05.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\7F91.tmp"C:\Users\Admin\AppData\Local\Temp\7F91.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\7FFF.tmp"C:\Users\Admin\AppData\Local\Temp\7FFF.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\805D.tmp"C:\Users\Admin\AppData\Local\Temp\805D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\80DA.tmp"C:\Users\Admin\AppData\Local\Temp\80DA.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\8166.tmp"C:\Users\Admin\AppData\Local\Temp\8166.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\81F3.tmp"C:\Users\Admin\AppData\Local\Temp\81F3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\8270.tmp"C:\Users\Admin\AppData\Local\Temp\8270.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\82FC.tmp"C:\Users\Admin\AppData\Local\Temp\82FC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\835A.tmp"C:\Users\Admin\AppData\Local\Temp\835A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\83E7.tmp"C:\Users\Admin\AppData\Local\Temp\83E7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8454.tmp"C:\Users\Admin\AppData\Local\Temp\8454.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\84F0.tmp"C:\Users\Admin\AppData\Local\Temp\84F0.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\857D.tmp"C:\Users\Admin\AppData\Local\Temp\857D.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\8629.tmp"C:\Users\Admin\AppData\Local\Temp\8629.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\86A6.tmp"C:\Users\Admin\AppData\Local\Temp\86A6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\8723.tmp"C:\Users\Admin\AppData\Local\Temp\8723.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\8781.tmp"C:\Users\Admin\AppData\Local\Temp\8781.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\880D.tmp"C:\Users\Admin\AppData\Local\Temp\880D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\886B.tmp"C:\Users\Admin\AppData\Local\Temp\886B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\88E8.tmp"C:\Users\Admin\AppData\Local\Temp\88E8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8984.tmp"C:\Users\Admin\AppData\Local\Temp\8984.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\8A11.tmp"C:\Users\Admin\AppData\Local\Temp\8A11.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\8A7E.tmp"C:\Users\Admin\AppData\Local\Temp\8A7E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\8AEC.tmp"C:\Users\Admin\AppData\Local\Temp\8AEC.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\8B69.tmp"C:\Users\Admin\AppData\Local\Temp\8B69.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\8BE6.tmp"C:\Users\Admin\AppData\Local\Temp\8BE6.tmp"65⤵
- Executes dropped EXE
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\8C63.tmp"C:\Users\Admin\AppData\Local\Temp\8C63.tmp"66⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\8CEF.tmp"C:\Users\Admin\AppData\Local\Temp\8CEF.tmp"67⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\8D6C.tmp"C:\Users\Admin\AppData\Local\Temp\8D6C.tmp"68⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\8DE9.tmp"C:\Users\Admin\AppData\Local\Temp\8DE9.tmp"69⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\8E66.tmp"C:\Users\Admin\AppData\Local\Temp\8E66.tmp"70⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\8ED4.tmp"C:\Users\Admin\AppData\Local\Temp\8ED4.tmp"71⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\8F51.tmp"C:\Users\Admin\AppData\Local\Temp\8F51.tmp"72⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\8FED.tmp"C:\Users\Admin\AppData\Local\Temp\8FED.tmp"73⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\9089.tmp"C:\Users\Admin\AppData\Local\Temp\9089.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\9116.tmp"C:\Users\Admin\AppData\Local\Temp\9116.tmp"75⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\9193.tmp"C:\Users\Admin\AppData\Local\Temp\9193.tmp"76⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\9200.tmp"C:\Users\Admin\AppData\Local\Temp\9200.tmp"77⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\929C.tmp"C:\Users\Admin\AppData\Local\Temp\929C.tmp"78⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\9329.tmp"C:\Users\Admin\AppData\Local\Temp\9329.tmp"79⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\93A6.tmp"C:\Users\Admin\AppData\Local\Temp\93A6.tmp"80⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\9423.tmp"C:\Users\Admin\AppData\Local\Temp\9423.tmp"81⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\94A0.tmp"C:\Users\Admin\AppData\Local\Temp\94A0.tmp"82⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\953C.tmp"C:\Users\Admin\AppData\Local\Temp\953C.tmp"83⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\95AA.tmp"C:\Users\Admin\AppData\Local\Temp\95AA.tmp"84⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\9627.tmp"C:\Users\Admin\AppData\Local\Temp\9627.tmp"85⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\9694.tmp"C:\Users\Admin\AppData\Local\Temp\9694.tmp"86⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\9711.tmp"C:\Users\Admin\AppData\Local\Temp\9711.tmp"87⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"88⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\984A.tmp"C:\Users\Admin\AppData\Local\Temp\984A.tmp"89⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\98E6.tmp"C:\Users\Admin\AppData\Local\Temp\98E6.tmp"90⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\9972.tmp"C:\Users\Admin\AppData\Local\Temp\9972.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"92⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\9A6C.tmp"C:\Users\Admin\AppData\Local\Temp\9A6C.tmp"93⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\9AE9.tmp"C:\Users\Admin\AppData\Local\Temp\9AE9.tmp"94⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\9B57.tmp"C:\Users\Admin\AppData\Local\Temp\9B57.tmp"95⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\9BC4.tmp"C:\Users\Admin\AppData\Local\Temp\9BC4.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\9C51.tmp"C:\Users\Admin\AppData\Local\Temp\9C51.tmp"97⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\9CED.tmp"C:\Users\Admin\AppData\Local\Temp\9CED.tmp"98⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\9D7A.tmp"C:\Users\Admin\AppData\Local\Temp\9D7A.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"100⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\9E93.tmp"C:\Users\Admin\AppData\Local\Temp\9E93.tmp"101⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\9F10.tmp"C:\Users\Admin\AppData\Local\Temp\9F10.tmp"102⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\9F8D.tmp"C:\Users\Admin\AppData\Local\Temp\9F8D.tmp"103⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\A00A.tmp"C:\Users\Admin\AppData\Local\Temp\A00A.tmp"104⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\A097.tmp"C:\Users\Admin\AppData\Local\Temp\A097.tmp"105⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\A104.tmp"C:\Users\Admin\AppData\Local\Temp\A104.tmp"106⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\A1B0.tmp"C:\Users\Admin\AppData\Local\Temp\A1B0.tmp"107⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\A22D.tmp"C:\Users\Admin\AppData\Local\Temp\A22D.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\A2B9.tmp"C:\Users\Admin\AppData\Local\Temp\A2B9.tmp"109⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\A327.tmp"C:\Users\Admin\AppData\Local\Temp\A327.tmp"110⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\A3C3.tmp"C:\Users\Admin\AppData\Local\Temp\A3C3.tmp"111⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\A450.tmp"C:\Users\Admin\AppData\Local\Temp\A450.tmp"112⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\A4EC.tmp"C:\Users\Admin\AppData\Local\Temp\A4EC.tmp"113⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\A559.tmp"C:\Users\Admin\AppData\Local\Temp\A559.tmp"114⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\A5E6.tmp"C:\Users\Admin\AppData\Local\Temp\A5E6.tmp"115⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\A663.tmp"C:\Users\Admin\AppData\Local\Temp\A663.tmp"116⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\A6E0.tmp"C:\Users\Admin\AppData\Local\Temp\A6E0.tmp"117⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\A76D.tmp"C:\Users\Admin\AppData\Local\Temp\A76D.tmp"118⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\A7EA.tmp"C:\Users\Admin\AppData\Local\Temp\A7EA.tmp"119⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\A895.tmp"C:\Users\Admin\AppData\Local\Temp\A895.tmp"120⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\A922.tmp"C:\Users\Admin\AppData\Local\Temp\A922.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\A98F.tmp"C:\Users\Admin\AppData\Local\Temp\A98F.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:4192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-