Analysis
- max time kernel
95s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_2bfa7c7e6dca83a041a423da150aa1f5_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_2bfa7c7e6dca83a041a423da150aa1f5_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-30_2bfa7c7e6dca83a041a423da150aa1f5_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260930-pypr7sws6m
- SHA256 2b651ff8834ca167f03d3de149493c3460289a56817bb28c1fa1623a8d63fd27
- MD5 2bfa7c7e6dca83a041a423da150aa1f5
- SHA1 7d1221383e121c3e45e95519c73cda1291cbf666
- SHA512 ae2ac89fa881f1fd7295e2f71de676bc8c08a9f7b94fd3b0dfcb2370594fc1fcf0ca92acfe9618c549050a66dec0b9f0d20585d830b1cfdf4c209c4193e8d3f9
- SSDEEP 12288:HU5rCOTeiJeq6BAn29tY9R4ltirnLENZ:HUQOJJeq6+otKMgnLEN
- TLSH T190B4F0257545C032E69212354AE6EBB2593E7C715B26A4C73B80BB7E2FB13C2E634307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4348 447.tmp 4776 502.tmp 4148 57F.tmp 5496 61C.tmp 404 689.tmp 8 706.tmp 3484 793.tmp 4932 810.tmp 5452 89C.tmp 5768 929.tmp 3780 9A6.tmp 856 A13.tmp 1552 B0D.tmp 2900 BD8.tmp 4732 C46.tmp 6024 CB3.tmp 5020 D21.tmp 4276 D7E.tmp 3116 DFB.tmp 3220 E69.tmp 2724 ED6.tmp 3036 F43.tmp 5924 FD0.tmp 3900 104D.tmp 4820 10CA.tmp 4484 1137.tmp 4324 11D4.tmp 5704 1260.tmp 2368 12CE.tmp 1668 134B.tmp 2156 13C8.tmp 3992 1435.tmp 2496 14A2.tmp 3960 152F.tmp 3692 159C.tmp 1264 160A.tmp 5112 1677.tmp 572 16E5.tmp 1320 1752.tmp 4060 17BF.tmp 1700 182D.tmp 1908 189A.tmp 5692 1907.tmp 5820 1975.tmp 3372 19F2.tmp 1644 1A5F.tmp 1420 1ACD.tmp 1004 1B3A.tmp 5428 1BA7.tmp 2500 1C15.tmp 5668 1C82.tmp 2136 1CEF.tmp 4248 1D5D.tmp 3544 1DCA.tmp 4100 1E38.tmp 632 1EA5.tmp 1252 1F12.tmp 6032 1F8F.tmp 4632 1FFD.tmp 836 205A.tmp 3828 20B8.tmp 4524 2126.tmp 5804 2193.tmp 2836 2200.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5475.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5034.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 589C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1260.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6051.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 396.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1401.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2442.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C46A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 559E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 614B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 324C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4382.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 639D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 295E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4816.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6BE.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2640 wrote to memory of 4348 2640 2026-09-30_2bfa7c7e6dca83a041a423da150aa1f5_elex_mafia_stealc_tofsee.exe 90 PID 4348 wrote to memory of 4776 4348 447.tmp 91 PID 4776 wrote to memory of 4148 4776 502.tmp 92 PID 4148 wrote to memory of 5496 4148 57F.tmp 93 PID 5496 wrote to memory of 404 5496 61C.tmp 94 PID 404 wrote to memory of 8 404 689.tmp 95 PID 8 wrote to memory of 3484 8 706.tmp 96 PID 3484 wrote to memory of 4932 3484 793.tmp 97 PID 4932 wrote to memory of 5452 4932 810.tmp 98 PID 5452 wrote to memory of 5768 5452 89C.tmp 99 PID 5768 wrote to memory of 3780 5768 929.tmp 100 PID 3780 wrote to memory of 856 3780 9A6.tmp 101 PID 856 wrote to memory of 1552 856 A13.tmp 102 PID 1552 wrote to memory of 2900 1552 B0D.tmp 103 PID 2900 wrote to memory of 4732 2900 BD8.tmp 104 PID 4732 wrote to memory of 6024 4732 C46.tmp 105 PID 6024 wrote to memory of 5020 6024 CB3.tmp 106 PID 5020 wrote to memory of 4276 5020 D21.tmp 107 PID 4276 wrote to memory of 3116 4276 D7E.tmp 108 PID 3116 wrote to memory of 3220 3116 DFB.tmp 109 PID 3220 wrote to memory of 2724 3220 E69.tmp 110 PID 2724 wrote to memory of 3036 2724 ED6.tmp 111 PID 3036 wrote to memory of 5924 3036 F43.tmp 112 PID 5924 wrote to memory of 3900 5924 FD0.tmp 113 PID 3900 wrote to memory of 4820 3900 104D.tmp 114 PID 4820 wrote to memory of 4484 4820 10CA.tmp 115 PID 4484 wrote to memory of 4324 4484 1137.tmp 116 PID 4324 wrote to memory of 5704 4324 11D4.tmp 117 PID 5704 wrote to memory of 2368 5704 1260.tmp 118 PID 2368 wrote to memory of 1668 2368 12CE.tmp 119 PID 1668 wrote to memory of 2156 1668 134B.tmp 120 PID 2156 wrote to memory of 3992 2156 13C8.tmp 121 PID 3992 wrote to memory of 2496 3992 1435.tmp 122 PID 2496 wrote to memory of 3960 2496 14A2.tmp 123 PID 3960 wrote to memory of 3692 3960 152F.tmp 124 PID 3692 wrote to memory of 1264 3692 159C.tmp 125 PID 1264 wrote to memory of 5112 1264 160A.tmp 126 PID 5112 wrote to memory of 572 5112 1677.tmp 127 PID 572 wrote to memory of 1320 572 16E5.tmp 128 PID 1320 wrote to memory of 4060 1320 1752.tmp 129 PID 4060 wrote to memory of 1700 4060 17BF.tmp 130 PID 1700 wrote to memory of 1908 1700 182D.tmp 131 PID 1908 wrote to memory of 5692 1908 189A.tmp 132 PID 5692 wrote to memory of 5820 5692 1907.tmp 133 PID 5820 wrote to memory of 3372 5820 1975.tmp 134 PID 3372 wrote to memory of 1644 3372 19F2.tmp 135 PID 1644 wrote to memory of 1420 1644 1A5F.tmp 136 PID 1420 wrote to memory of 1004 1420 1ACD.tmp 137 PID 1004 wrote to memory of 5428 1004 1B3A.tmp 138 PID 5428 wrote to memory of 2500 5428 1BA7.tmp 139 PID 2500 wrote to memory of 5668 2500 1C15.tmp 140 PID 5668 wrote to memory of 2136 5668 1C82.tmp 141 PID 2136 wrote to memory of 4248 2136 1CEF.tmp 142 PID 4248 wrote to memory of 3544 4248 1D5D.tmp 143 PID 3544 wrote to memory of 4100 3544 1DCA.tmp 144 PID 4100 wrote to memory of 632 4100 1E38.tmp 145 PID 632 wrote to memory of 1252 632 1EA5.tmp 146 PID 1252 wrote to memory of 6032 1252 1F12.tmp 147 PID 6032 wrote to memory of 4632 6032 1F8F.tmp 148 PID 4632 wrote to memory of 836 4632 1FFD.tmp 149 PID 836 wrote to memory of 3828 836 205A.tmp 150 PID 3828 wrote to memory of 4524 3828 20B8.tmp 151 PID 4524 wrote to memory of 5804 4524 2126.tmp 152 PID 5804 wrote to memory of 2836 5804 2193.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_2bfa7c7e6dca83a041a423da150aa1f5_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_2bfa7c7e6dca83a041a423da150aa1f5_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\447.tmp"C:\Users\Admin\AppData\Local\Temp\447.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\502.tmp"C:\Users\Admin\AppData\Local\Temp\502.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\57F.tmp"C:\Users\Admin\AppData\Local\Temp\57F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\61C.tmp"C:\Users\Admin\AppData\Local\Temp\61C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\689.tmp"C:\Users\Admin\AppData\Local\Temp\689.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\706.tmp"C:\Users\Admin\AppData\Local\Temp\706.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\793.tmp"C:\Users\Admin\AppData\Local\Temp\793.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\810.tmp"C:\Users\Admin\AppData\Local\Temp\810.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\89C.tmp"C:\Users\Admin\AppData\Local\Temp\89C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\929.tmp"C:\Users\Admin\AppData\Local\Temp\929.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\9A6.tmp"C:\Users\Admin\AppData\Local\Temp\9A6.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\A13.tmp"C:\Users\Admin\AppData\Local\Temp\A13.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\BD8.tmp"C:\Users\Admin\AppData\Local\Temp\BD8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\C46.tmp"C:\Users\Admin\AppData\Local\Temp\C46.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\CB3.tmp"C:\Users\Admin\AppData\Local\Temp\CB3.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\D21.tmp"C:\Users\Admin\AppData\Local\Temp\D21.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\D7E.tmp"C:\Users\Admin\AppData\Local\Temp\D7E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\DFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\E69.tmp"C:\Users\Admin\AppData\Local\Temp\E69.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\ED6.tmp"C:\Users\Admin\AppData\Local\Temp\ED6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\F43.tmp"C:\Users\Admin\AppData\Local\Temp\F43.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\FD0.tmp"C:\Users\Admin\AppData\Local\Temp\FD0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\104D.tmp"C:\Users\Admin\AppData\Local\Temp\104D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\10CA.tmp"C:\Users\Admin\AppData\Local\Temp\10CA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\1137.tmp"C:\Users\Admin\AppData\Local\Temp\1137.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\11D4.tmp"C:\Users\Admin\AppData\Local\Temp\11D4.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\1260.tmp"C:\Users\Admin\AppData\Local\Temp\1260.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\12CE.tmp"C:\Users\Admin\AppData\Local\Temp\12CE.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\134B.tmp"C:\Users\Admin\AppData\Local\Temp\134B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\13C8.tmp"C:\Users\Admin\AppData\Local\Temp\13C8.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1435.tmp"C:\Users\Admin\AppData\Local\Temp\1435.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\14A2.tmp"C:\Users\Admin\AppData\Local\Temp\14A2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\152F.tmp"C:\Users\Admin\AppData\Local\Temp\152F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\159C.tmp"C:\Users\Admin\AppData\Local\Temp\159C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\160A.tmp"C:\Users\Admin\AppData\Local\Temp\160A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\1677.tmp"C:\Users\Admin\AppData\Local\Temp\1677.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\16E5.tmp"C:\Users\Admin\AppData\Local\Temp\16E5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\1752.tmp"C:\Users\Admin\AppData\Local\Temp\1752.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\17BF.tmp"C:\Users\Admin\AppData\Local\Temp\17BF.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\182D.tmp"C:\Users\Admin\AppData\Local\Temp\182D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\189A.tmp"C:\Users\Admin\AppData\Local\Temp\189A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\1907.tmp"C:\Users\Admin\AppData\Local\Temp\1907.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\1975.tmp"C:\Users\Admin\AppData\Local\Temp\1975.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\19F2.tmp"C:\Users\Admin\AppData\Local\Temp\19F2.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\1A5F.tmp"C:\Users\Admin\AppData\Local\Temp\1A5F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\1C15.tmp"C:\Users\Admin\AppData\Local\Temp\1C15.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\1C82.tmp"C:\Users\Admin\AppData\Local\Temp\1C82.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\1E38.tmp"C:\Users\Admin\AppData\Local\Temp\1E38.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\1F12.tmp"C:\Users\Admin\AppData\Local\Temp\1F12.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\1F8F.tmp"C:\Users\Admin\AppData\Local\Temp\1F8F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\205A.tmp"C:\Users\Admin\AppData\Local\Temp\205A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\20B8.tmp"C:\Users\Admin\AppData\Local\Temp\20B8.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\2126.tmp"C:\Users\Admin\AppData\Local\Temp\2126.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\2193.tmp"C:\Users\Admin\AppData\Local\Temp\2193.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\2200.tmp"C:\Users\Admin\AppData\Local\Temp\2200.tmp"65⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\226E.tmp"C:\Users\Admin\AppData\Local\Temp\226E.tmp"66⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"67⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\23A6.tmp"C:\Users\Admin\AppData\Local\Temp\23A6.tmp"68⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2442.tmp"C:\Users\Admin\AppData\Local\Temp\2442.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"70⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"71⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"72⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"73⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\26C3.tmp"C:\Users\Admin\AppData\Local\Temp\26C3.tmp"74⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\2740.tmp"C:\Users\Admin\AppData\Local\Temp\2740.tmp"75⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\27CD.tmp"C:\Users\Admin\AppData\Local\Temp\27CD.tmp"76⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\2879.tmp"C:\Users\Admin\AppData\Local\Temp\2879.tmp"77⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\28E6.tmp"C:\Users\Admin\AppData\Local\Temp\28E6.tmp"78⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\2963.tmp"C:\Users\Admin\AppData\Local\Temp\2963.tmp"79⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\29FF.tmp"C:\Users\Admin\AppData\Local\Temp\29FF.tmp"80⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"81⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\2B38.tmp"C:\Users\Admin\AppData\Local\Temp\2B38.tmp"82⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"83⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\2C32.tmp"C:\Users\Admin\AppData\Local\Temp\2C32.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"85⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"86⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"87⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\2E74.tmp"C:\Users\Admin\AppData\Local\Temp\2E74.tmp"88⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\2EF1.tmp"C:\Users\Admin\AppData\Local\Temp\2EF1.tmp"89⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"90⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\3049.tmp"C:\Users\Admin\AppData\Local\Temp\3049.tmp"91⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\30C6.tmp"C:\Users\Admin\AppData\Local\Temp\30C6.tmp"92⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\3143.tmp"C:\Users\Admin\AppData\Local\Temp\3143.tmp"93⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\31C0.tmp"C:\Users\Admin\AppData\Local\Temp\31C0.tmp"94⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\324C.tmp"C:\Users\Admin\AppData\Local\Temp\324C.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\32E8.tmp"C:\Users\Admin\AppData\Local\Temp\32E8.tmp"96⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\3375.tmp"C:\Users\Admin\AppData\Local\Temp\3375.tmp"97⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\33F2.tmp"C:\Users\Admin\AppData\Local\Temp\33F2.tmp"98⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\348E.tmp"C:\Users\Admin\AppData\Local\Temp\348E.tmp"99⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\353A.tmp"C:\Users\Admin\AppData\Local\Temp\353A.tmp"100⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\35C7.tmp"C:\Users\Admin\AppData\Local\Temp\35C7.tmp"101⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\3653.tmp"C:\Users\Admin\AppData\Local\Temp\3653.tmp"102⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\36D0.tmp"C:\Users\Admin\AppData\Local\Temp\36D0.tmp"103⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\375D.tmp"C:\Users\Admin\AppData\Local\Temp\375D.tmp"104⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\37DA.tmp"C:\Users\Admin\AppData\Local\Temp\37DA.tmp"105⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\3847.tmp"C:\Users\Admin\AppData\Local\Temp\3847.tmp"106⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\38D4.tmp"C:\Users\Admin\AppData\Local\Temp\38D4.tmp"107⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\3970.tmp"C:\Users\Admin\AppData\Local\Temp\3970.tmp"108⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\39FD.tmp"C:\Users\Admin\AppData\Local\Temp\39FD.tmp"109⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\3A8A.tmp"C:\Users\Admin\AppData\Local\Temp\3A8A.tmp"110⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\3AF7.tmp"C:\Users\Admin\AppData\Local\Temp\3AF7.tmp"111⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\3B93.tmp"C:\Users\Admin\AppData\Local\Temp\3B93.tmp"112⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\3C3F.tmp"C:\Users\Admin\AppData\Local\Temp\3C3F.tmp"113⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3CAC.tmp"C:\Users\Admin\AppData\Local\Temp\3CAC.tmp"114⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\3D1A.tmp"C:\Users\Admin\AppData\Local\Temp\3D1A.tmp"115⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\3D87.tmp"C:\Users\Admin\AppData\Local\Temp\3D87.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\3E23.tmp"C:\Users\Admin\AppData\Local\Temp\3E23.tmp"117⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\3EB0.tmp"C:\Users\Admin\AppData\Local\Temp\3EB0.tmp"118⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\3F3D.tmp"C:\Users\Admin\AppData\Local\Temp\3F3D.tmp"119⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\3FBA.tmp"C:\Users\Admin\AppData\Local\Temp\3FBA.tmp"120⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\4037.tmp"C:\Users\Admin\AppData\Local\Temp\4037.tmp"121⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\40A4.tmp"C:\Users\Admin\AppData\Local\Temp\40A4.tmp"122⤵PID:4476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-