Analysis
- max time kernel
107s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 14:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_f4500035caca152cf381b3b6a59f86ea_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_f4500035caca152cf381b3b6a59f86ea_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-29_f4500035caca152cf381b3b6a59f86ea_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260930-scshrawhrf
- SHA256 816a544def9e4db1016547e7e39384ab61fc0ecac741c5ae6533573661851666
- MD5 f4500035caca152cf381b3b6a59f86ea
- SHA1 cd43f61cb972b061a9b50cd898e976f8adb442b0
- SHA512 d56e1bef7cd3f776f870c143d6c453ad693e9755cf16c23bdc4bd772c1d8449047ae65aa0b53defdf1824bf839b49b512b98c3d7fd6b2f352b51467aaa31ced4
- SSDEEP 12288:NU5rCOTeijisTBoRhPcwtL2jXC5o0GTZwlH:NUQOJjHy7PhL2LDRTSlH
- TLSH T121B4F1267645C032E69302310AE7DFB26A3B7C315B66A4C33B84637E2EB16D1E775346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4100 62F1.tmp 2988 63DC.tmp 3416 64E5.tmp 1168 65D0.tmp 4856 666C.tmp 5780 6747.tmp 3716 67F3.tmp 720 6870.tmp 3052 695A.tmp 5432 6A64.tmp 3208 6B4E.tmp 3392 6BFA.tmp 4452 6C96.tmp 4476 6DA0.tmp 4680 6E3C.tmp 4692 6F26.tmp 5104 6FD2.tmp 4556 707E.tmp 760 7159.tmp 1108 71E5.tmp 2192 72D0.tmp 800 738B.tmp 5372 7418.tmp 3116 74A5.tmp 3268 7512.tmp 4568 759F.tmp 3324 766A.tmp 4932 7716.tmp 5148 77D1.tmp 240 785E.tmp 1044 790A.tmp 3496 79B5.tmp 4276 7AA0.tmp 2984 7B2C.tmp 2068 7BA9.tmp 4272 7C36.tmp 4284 7CC3.tmp 2936 7D4F.tmp 3336 7DBD.tmp 5796 7E2A.tmp 5800 7EB7.tmp 1120 7F63.tmp 3948 7FE0.tmp 5204 808B.tmp 3912 80F9.tmp 5200 8185.tmp 3768 8222.tmp 2972 828F.tmp 4532 830C.tmp 5352 8399.tmp 2436 8416.tmp 4612 84B2.tmp 5216 854E.tmp 3612 85FA.tmp 3100 8687.tmp 5960 8704.tmp 1900 8771.tmp 4664 87EE.tmp 5812 888A.tmp 4884 8917.tmp 5564 89B3.tmp 2568 8A4F.tmp 4308 8AFB.tmp 5636 8B98.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B449.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1578.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E115.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6686.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 998D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E57A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E05F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F78B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4487.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 854E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A077.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D33F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 347A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 888A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1895.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F965.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6713.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 738B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BDF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4232 wrote to memory of 4100 4232 2026-09-29_f4500035caca152cf381b3b6a59f86ea_elex_mafia_stealc_tofsee.exe 89 PID 4100 wrote to memory of 2988 4100 62F1.tmp 90 PID 2988 wrote to memory of 3416 2988 63DC.tmp 91 PID 3416 wrote to memory of 1168 3416 64E5.tmp 92 PID 1168 wrote to memory of 4856 1168 65D0.tmp 93 PID 4856 wrote to memory of 5780 4856 666C.tmp 94 PID 5780 wrote to memory of 3716 5780 6747.tmp 95 PID 3716 wrote to memory of 720 3716 67F3.tmp 96 PID 720 wrote to memory of 3052 720 6870.tmp 97 PID 3052 wrote to memory of 5432 3052 695A.tmp 98 PID 5432 wrote to memory of 3208 5432 6A64.tmp 99 PID 3208 wrote to memory of 3392 3208 6B4E.tmp 100 PID 3392 wrote to memory of 4452 3392 6BFA.tmp 101 PID 4452 wrote to memory of 4476 4452 6C96.tmp 102 PID 4476 wrote to memory of 4680 4476 6DA0.tmp 103 PID 4680 wrote to memory of 4692 4680 6E3C.tmp 104 PID 4692 wrote to memory of 5104 4692 6F26.tmp 105 PID 5104 wrote to memory of 4556 5104 6FD2.tmp 106 PID 4556 wrote to memory of 760 4556 707E.tmp 107 PID 760 wrote to memory of 1108 760 7159.tmp 108 PID 1108 wrote to memory of 2192 1108 71E5.tmp 109 PID 2192 wrote to memory of 800 2192 72D0.tmp 110 PID 800 wrote to memory of 5372 800 738B.tmp 111 PID 5372 wrote to memory of 3116 5372 7418.tmp 112 PID 3116 wrote to memory of 3268 3116 74A5.tmp 113 PID 3268 wrote to memory of 4568 3268 7512.tmp 114 PID 4568 wrote to memory of 3324 4568 759F.tmp 115 PID 3324 wrote to memory of 4932 3324 766A.tmp 116 PID 4932 wrote to memory of 5148 4932 7716.tmp 117 PID 5148 wrote to memory of 240 5148 77D1.tmp 118 PID 240 wrote to memory of 1044 240 785E.tmp 119 PID 1044 wrote to memory of 3496 1044 790A.tmp 120 PID 3496 wrote to memory of 4276 3496 79B5.tmp 121 PID 4276 wrote to memory of 2984 4276 7AA0.tmp 122 PID 2984 wrote to memory of 2068 2984 7B2C.tmp 123 PID 2068 wrote to memory of 4272 2068 7BA9.tmp 124 PID 4272 wrote to memory of 4284 4272 7C36.tmp 125 PID 4284 wrote to memory of 2936 4284 7CC3.tmp 126 PID 2936 wrote to memory of 3336 2936 7D4F.tmp 127 PID 3336 wrote to memory of 5796 3336 7DBD.tmp 128 PID 5796 wrote to memory of 5800 5796 7E2A.tmp 129 PID 5800 wrote to memory of 1120 5800 7EB7.tmp 130 PID 1120 wrote to memory of 3948 1120 7F63.tmp 131 PID 3948 wrote to memory of 5204 3948 7FE0.tmp 132 PID 5204 wrote to memory of 3912 5204 808B.tmp 133 PID 3912 wrote to memory of 5200 3912 80F9.tmp 134 PID 5200 wrote to memory of 3768 5200 8185.tmp 135 PID 3768 wrote to memory of 2972 3768 8222.tmp 136 PID 2972 wrote to memory of 4532 2972 828F.tmp 137 PID 4532 wrote to memory of 5352 4532 830C.tmp 138 PID 5352 wrote to memory of 2436 5352 8399.tmp 139 PID 2436 wrote to memory of 4612 2436 8416.tmp 140 PID 4612 wrote to memory of 5216 4612 84B2.tmp 141 PID 5216 wrote to memory of 3612 5216 854E.tmp 142 PID 3612 wrote to memory of 3100 3612 85FA.tmp 143 PID 3100 wrote to memory of 5960 3100 8687.tmp 144 PID 5960 wrote to memory of 1900 5960 8704.tmp 145 PID 1900 wrote to memory of 4664 1900 8771.tmp 146 PID 4664 wrote to memory of 5812 4664 87EE.tmp 147 PID 5812 wrote to memory of 4884 5812 888A.tmp 148 PID 4884 wrote to memory of 5564 4884 8917.tmp 149 PID 5564 wrote to memory of 2568 5564 89B3.tmp 150 PID 2568 wrote to memory of 4308 2568 8A4F.tmp 151 PID 4308 wrote to memory of 5636 4308 8AFB.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_f4500035caca152cf381b3b6a59f86ea_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_f4500035caca152cf381b3b6a59f86ea_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\62F1.tmp"C:\Users\Admin\AppData\Local\Temp\62F1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\63DC.tmp"C:\Users\Admin\AppData\Local\Temp\63DC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\64E5.tmp"C:\Users\Admin\AppData\Local\Temp\64E5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\65D0.tmp"C:\Users\Admin\AppData\Local\Temp\65D0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\666C.tmp"C:\Users\Admin\AppData\Local\Temp\666C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\6747.tmp"C:\Users\Admin\AppData\Local\Temp\6747.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\67F3.tmp"C:\Users\Admin\AppData\Local\Temp\67F3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\6870.tmp"C:\Users\Admin\AppData\Local\Temp\6870.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\695A.tmp"C:\Users\Admin\AppData\Local\Temp\695A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\6A64.tmp"C:\Users\Admin\AppData\Local\Temp\6A64.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\6B4E.tmp"C:\Users\Admin\AppData\Local\Temp\6B4E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\6BFA.tmp"C:\Users\Admin\AppData\Local\Temp\6BFA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\6C96.tmp"C:\Users\Admin\AppData\Local\Temp\6C96.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\6E3C.tmp"C:\Users\Admin\AppData\Local\Temp\6E3C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\6F26.tmp"C:\Users\Admin\AppData\Local\Temp\6F26.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\707E.tmp"C:\Users\Admin\AppData\Local\Temp\707E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\7159.tmp"C:\Users\Admin\AppData\Local\Temp\7159.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\72D0.tmp"C:\Users\Admin\AppData\Local\Temp\72D0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\7418.tmp"C:\Users\Admin\AppData\Local\Temp\7418.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\74A5.tmp"C:\Users\Admin\AppData\Local\Temp\74A5.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\7512.tmp"C:\Users\Admin\AppData\Local\Temp\7512.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\759F.tmp"C:\Users\Admin\AppData\Local\Temp\759F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\766A.tmp"C:\Users\Admin\AppData\Local\Temp\766A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\7716.tmp"C:\Users\Admin\AppData\Local\Temp\7716.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\77D1.tmp"C:\Users\Admin\AppData\Local\Temp\77D1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\785E.tmp"C:\Users\Admin\AppData\Local\Temp\785E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\790A.tmp"C:\Users\Admin\AppData\Local\Temp\790A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\79B5.tmp"C:\Users\Admin\AppData\Local\Temp\79B5.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\7B2C.tmp"C:\Users\Admin\AppData\Local\Temp\7B2C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\7BA9.tmp"C:\Users\Admin\AppData\Local\Temp\7BA9.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\7C36.tmp"C:\Users\Admin\AppData\Local\Temp\7C36.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\7CC3.tmp"C:\Users\Admin\AppData\Local\Temp\7CC3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\7D4F.tmp"C:\Users\Admin\AppData\Local\Temp\7D4F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\7E2A.tmp"C:\Users\Admin\AppData\Local\Temp\7E2A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\7F63.tmp"C:\Users\Admin\AppData\Local\Temp\7F63.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\7FE0.tmp"C:\Users\Admin\AppData\Local\Temp\7FE0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\808B.tmp"C:\Users\Admin\AppData\Local\Temp\808B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\80F9.tmp"C:\Users\Admin\AppData\Local\Temp\80F9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\8185.tmp"C:\Users\Admin\AppData\Local\Temp\8185.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\8222.tmp"C:\Users\Admin\AppData\Local\Temp\8222.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\828F.tmp"C:\Users\Admin\AppData\Local\Temp\828F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\830C.tmp"C:\Users\Admin\AppData\Local\Temp\830C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\8399.tmp"C:\Users\Admin\AppData\Local\Temp\8399.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\8416.tmp"C:\Users\Admin\AppData\Local\Temp\8416.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\84B2.tmp"C:\Users\Admin\AppData\Local\Temp\84B2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\854E.tmp"C:\Users\Admin\AppData\Local\Temp\854E.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\85FA.tmp"C:\Users\Admin\AppData\Local\Temp\85FA.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\8687.tmp"C:\Users\Admin\AppData\Local\Temp\8687.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\8704.tmp"C:\Users\Admin\AppData\Local\Temp\8704.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\8771.tmp"C:\Users\Admin\AppData\Local\Temp\8771.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\87EE.tmp"C:\Users\Admin\AppData\Local\Temp\87EE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\888A.tmp"C:\Users\Admin\AppData\Local\Temp\888A.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\8917.tmp"C:\Users\Admin\AppData\Local\Temp\8917.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\89B3.tmp"C:\Users\Admin\AppData\Local\Temp\89B3.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\8A4F.tmp"C:\Users\Admin\AppData\Local\Temp\8A4F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\8AFB.tmp"C:\Users\Admin\AppData\Local\Temp\8AFB.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\8B98.tmp"C:\Users\Admin\AppData\Local\Temp\8B98.tmp"65⤵
- Executes dropped EXE
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\8C24.tmp"C:\Users\Admin\AppData\Local\Temp\8C24.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\8CA1.tmp"C:\Users\Admin\AppData\Local\Temp\8CA1.tmp"67⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\8D1E.tmp"C:\Users\Admin\AppData\Local\Temp\8D1E.tmp"68⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"69⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\8E47.tmp"C:\Users\Admin\AppData\Local\Temp\8E47.tmp"70⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\8EE3.tmp"C:\Users\Admin\AppData\Local\Temp\8EE3.tmp"71⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\8F51.tmp"C:\Users\Admin\AppData\Local\Temp\8F51.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\8FFD.tmp"C:\Users\Admin\AppData\Local\Temp\8FFD.tmp"73⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\90C8.tmp"C:\Users\Admin\AppData\Local\Temp\90C8.tmp"74⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\9135.tmp"C:\Users\Admin\AppData\Local\Temp\9135.tmp"75⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\91C2.tmp"C:\Users\Admin\AppData\Local\Temp\91C2.tmp"76⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\926E.tmp"C:\Users\Admin\AppData\Local\Temp\926E.tmp"77⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\92EB.tmp"C:\Users\Admin\AppData\Local\Temp\92EB.tmp"78⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\93B6.tmp"C:\Users\Admin\AppData\Local\Temp\93B6.tmp"79⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\9423.tmp"C:\Users\Admin\AppData\Local\Temp\9423.tmp"80⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\94BF.tmp"C:\Users\Admin\AppData\Local\Temp\94BF.tmp"81⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\955C.tmp"C:\Users\Admin\AppData\Local\Temp\955C.tmp"82⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\95F8.tmp"C:\Users\Admin\AppData\Local\Temp\95F8.tmp"83⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\9694.tmp"C:\Users\Admin\AppData\Local\Temp\9694.tmp"84⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\9701.tmp"C:\Users\Admin\AppData\Local\Temp\9701.tmp"85⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"86⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"87⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\9898.tmp"C:\Users\Admin\AppData\Local\Temp\9898.tmp"88⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"89⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\99B1.tmp"C:\Users\Admin\AppData\Local\Temp\99B1.tmp"90⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\9A4D.tmp"C:\Users\Admin\AppData\Local\Temp\9A4D.tmp"91⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\9ACA.tmp"C:\Users\Admin\AppData\Local\Temp\9ACA.tmp"92⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\9B57.tmp"C:\Users\Admin\AppData\Local\Temp\9B57.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\9C03.tmp"C:\Users\Admin\AppData\Local\Temp\9C03.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\9C80.tmp"C:\Users\Admin\AppData\Local\Temp\9C80.tmp"95⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\9CFD.tmp"C:\Users\Admin\AppData\Local\Temp\9CFD.tmp"96⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\9D99.tmp"C:\Users\Admin\AppData\Local\Temp\9D99.tmp"97⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\9E16.tmp"C:\Users\Admin\AppData\Local\Temp\9E16.tmp"98⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\9EB2.tmp"C:\Users\Admin\AppData\Local\Temp\9EB2.tmp"99⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\9F4E.tmp"C:\Users\Admin\AppData\Local\Temp\9F4E.tmp"100⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\9FDB.tmp"C:\Users\Admin\AppData\Local\Temp\9FDB.tmp"101⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\A077.tmp"C:\Users\Admin\AppData\Local\Temp\A077.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\A0F4.tmp"C:\Users\Admin\AppData\Local\Temp\A0F4.tmp"103⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\A162.tmp"C:\Users\Admin\AppData\Local\Temp\A162.tmp"104⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\A1FE.tmp"C:\Users\Admin\AppData\Local\Temp\A1FE.tmp"105⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\A27B.tmp"C:\Users\Admin\AppData\Local\Temp\A27B.tmp"106⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\A308.tmp"C:\Users\Admin\AppData\Local\Temp\A308.tmp"107⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\A394.tmp"C:\Users\Admin\AppData\Local\Temp\A394.tmp"108⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\A402.tmp"C:\Users\Admin\AppData\Local\Temp\A402.tmp"109⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\A48E.tmp"C:\Users\Admin\AppData\Local\Temp\A48E.tmp"110⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\A52A.tmp"C:\Users\Admin\AppData\Local\Temp\A52A.tmp"111⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\A5C7.tmp"C:\Users\Admin\AppData\Local\Temp\A5C7.tmp"112⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\A663.tmp"C:\Users\Admin\AppData\Local\Temp\A663.tmp"113⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\A6F0.tmp"C:\Users\Admin\AppData\Local\Temp\A6F0.tmp"114⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\A75D.tmp"C:\Users\Admin\AppData\Local\Temp\A75D.tmp"115⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\A7EA.tmp"C:\Users\Admin\AppData\Local\Temp\A7EA.tmp"116⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\A876.tmp"C:\Users\Admin\AppData\Local\Temp\A876.tmp"117⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\A922.tmp"C:\Users\Admin\AppData\Local\Temp\A922.tmp"118⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\A9BE.tmp"C:\Users\Admin\AppData\Local\Temp\A9BE.tmp"119⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\AA5B.tmp"C:\Users\Admin\AppData\Local\Temp\AA5B.tmp"120⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\AB16.tmp"C:\Users\Admin\AppData\Local\Temp\AB16.tmp"121⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\AB93.tmp"C:\Users\Admin\AppData\Local\Temp\AB93.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-