Analysis
- max time kernel
123s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_a52bba1a3a081a9e3787ad7544dd86de_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_a52bba1a3a081a9e3787ad7544dd86de_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-22_a52bba1a3a081a9e3787ad7544dd86de_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample261024-cdeehsww2p
- SHA256 5792a58b8ec498376505f1f303eaf80980c7b6bf760bd4c7b2b7b5d666d71470
- MD5 a52bba1a3a081a9e3787ad7544dd86de
- SHA1 f901320f3290fdddde8e1a4a39315fad7a02990f
- SHA512 6ca142acccf61c7c9cf0c3ffd765621523db767eb026884036b75cffa142cce138c8f1eee82902733f8949d25ae1b17f334a6b32d5127fc38dfc2c0c270ce16d
- SSDEEP 12288:9U5rCOTei6I4DTr3xSskLXraqZoXWjdq:9UQOJ6FD/h6LWqqGh
- TLSH T1BCC4F1257685C436E9D211314AE2EBB1297E7C314B2664C73B90777E6FB12E1E73830A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1972 617A.tmp 2140 6217.tmp 5516 6330.tmp 4408 63FB.tmp 4860 6468.tmp 616 6505.tmp 5208 65DF.tmp 1504 6A83.tmp 3368 6B0F.tmp 3096 6B9C.tmp 4084 6C38.tmp 5452 6CC5.tmp 4268 6D61.tmp 4480 6DEE.tmp 4376 6E8A.tmp 2680 6F17.tmp 4604 6F94.tmp 5152 7040.tmp 1636 70FB.tmp 860 7168.tmp 2044 7205.tmp 3808 7291.tmp 5164 734D.tmp 5004 73D9.tmp 3224 7495.tmp 4540 7550.tmp 3128 75FC.tmp 5472 76C7.tmp 1268 7783.tmp 452 783E.tmp 1780 78AC.tmp 4164 7929.tmp 3704 79C5.tmp 3000 7A32.tmp 5448 7AAF.tmp 3628 7B1D.tmp 3176 7B9A.tmp 2924 7C07.tmp 2560 7C75.tmp 4720 7CD2.tmp 2912 7D30.tmp 3104 7DAD.tmp 6080 7E1A.tmp 1284 7E88.tmp 5156 7ED6.tmp 1880 7F43.tmp 1088 7FD0.tmp 2332 806C.tmp 4036 80E9.tmp 5888 8166.tmp 1116 81F3.tmp 4152 8251.tmp 3788 82CE.tmp 4688 834B.tmp 1368 83B8.tmp 3112 8435.tmp 6072 84C2.tmp 3124 854E.tmp 5592 85DB.tmp 4008 8658.tmp 5600 86B6.tmp 3284 8713.tmp 2568 8781.tmp 4176 87EE.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A600.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D57D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 170A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5938.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B70D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F53E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A852.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 311F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F912.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1862.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 689A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84CC.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4232 wrote to memory of 1972 4232 2026-10-22_a52bba1a3a081a9e3787ad7544dd86de_elex_mafia_stealc_tofsee.exe 89 PID 1972 wrote to memory of 2140 1972 617A.tmp 90 PID 2140 wrote to memory of 5516 2140 6217.tmp 91 PID 5516 wrote to memory of 4408 5516 6330.tmp 92 PID 4408 wrote to memory of 4860 4408 63FB.tmp 93 PID 4860 wrote to memory of 616 4860 6468.tmp 94 PID 616 wrote to memory of 5208 616 6505.tmp 95 PID 5208 wrote to memory of 1504 5208 65DF.tmp 96 PID 1504 wrote to memory of 3368 1504 6A83.tmp 97 PID 3368 wrote to memory of 3096 3368 6B0F.tmp 98 PID 3096 wrote to memory of 4084 3096 6B9C.tmp 99 PID 4084 wrote to memory of 5452 4084 6C38.tmp 100 PID 5452 wrote to memory of 4268 5452 6CC5.tmp 101 PID 4268 wrote to memory of 4480 4268 6D61.tmp 102 PID 4480 wrote to memory of 4376 4480 6DEE.tmp 103 PID 4376 wrote to memory of 2680 4376 6E8A.tmp 104 PID 2680 wrote to memory of 4604 2680 6F17.tmp 105 PID 4604 wrote to memory of 5152 4604 6F94.tmp 106 PID 5152 wrote to memory of 1636 5152 7040.tmp 107 PID 1636 wrote to memory of 860 1636 70FB.tmp 108 PID 860 wrote to memory of 2044 860 7168.tmp 109 PID 2044 wrote to memory of 3808 2044 7205.tmp 110 PID 3808 wrote to memory of 5164 3808 7291.tmp 111 PID 5164 wrote to memory of 5004 5164 734D.tmp 112 PID 5004 wrote to memory of 3224 5004 73D9.tmp 113 PID 3224 wrote to memory of 4540 3224 7495.tmp 114 PID 4540 wrote to memory of 3128 4540 7550.tmp 115 PID 3128 wrote to memory of 5472 3128 75FC.tmp 116 PID 5472 wrote to memory of 1268 5472 76C7.tmp 117 PID 1268 wrote to memory of 452 1268 7783.tmp 118 PID 452 wrote to memory of 1780 452 783E.tmp 119 PID 1780 wrote to memory of 4164 1780 78AC.tmp 120 PID 4164 wrote to memory of 3704 4164 7929.tmp 121 PID 3704 wrote to memory of 3000 3704 79C5.tmp 122 PID 3000 wrote to memory of 5448 3000 7A32.tmp 123 PID 5448 wrote to memory of 3628 5448 7AAF.tmp 124 PID 3628 wrote to memory of 3176 3628 7B1D.tmp 125 PID 3176 wrote to memory of 2924 3176 7B9A.tmp 126 PID 2924 wrote to memory of 2560 2924 7C07.tmp 127 PID 2560 wrote to memory of 4720 2560 7C75.tmp 128 PID 4720 wrote to memory of 2912 4720 7CD2.tmp 129 PID 2912 wrote to memory of 3104 2912 7D30.tmp 130 PID 3104 wrote to memory of 6080 3104 7DAD.tmp 131 PID 6080 wrote to memory of 1284 6080 7E1A.tmp 132 PID 1284 wrote to memory of 5156 1284 7E88.tmp 133 PID 5156 wrote to memory of 1880 5156 7ED6.tmp 134 PID 1880 wrote to memory of 1088 1880 7F43.tmp 135 PID 1088 wrote to memory of 2332 1088 7FD0.tmp 136 PID 2332 wrote to memory of 4036 2332 806C.tmp 137 PID 4036 wrote to memory of 5888 4036 80E9.tmp 138 PID 5888 wrote to memory of 1116 5888 8166.tmp 139 PID 1116 wrote to memory of 4152 1116 81F3.tmp 140 PID 4152 wrote to memory of 3788 4152 8251.tmp 141 PID 3788 wrote to memory of 4688 3788 82CE.tmp 142 PID 4688 wrote to memory of 1368 4688 834B.tmp 143 PID 1368 wrote to memory of 3112 1368 83B8.tmp 144 PID 3112 wrote to memory of 6072 3112 8435.tmp 145 PID 6072 wrote to memory of 3124 6072 84C2.tmp 146 PID 3124 wrote to memory of 5592 3124 854E.tmp 147 PID 5592 wrote to memory of 4008 5592 85DB.tmp 148 PID 4008 wrote to memory of 5600 4008 8658.tmp 149 PID 5600 wrote to memory of 3284 5600 86B6.tmp 150 PID 3284 wrote to memory of 2568 3284 8713.tmp 151 PID 2568 wrote to memory of 4176 2568 8781.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_a52bba1a3a081a9e3787ad7544dd86de_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a52bba1a3a081a9e3787ad7544dd86de_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\617A.tmp"C:\Users\Admin\AppData\Local\Temp\617A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\6217.tmp"C:\Users\Admin\AppData\Local\Temp\6217.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\6330.tmp"C:\Users\Admin\AppData\Local\Temp\6330.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\63FB.tmp"C:\Users\Admin\AppData\Local\Temp\63FB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\6468.tmp"C:\Users\Admin\AppData\Local\Temp\6468.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\6505.tmp"C:\Users\Admin\AppData\Local\Temp\6505.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\65DF.tmp"C:\Users\Admin\AppData\Local\Temp\65DF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\6A83.tmp"C:\Users\Admin\AppData\Local\Temp\6A83.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\6B0F.tmp"C:\Users\Admin\AppData\Local\Temp\6B0F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\6B9C.tmp"C:\Users\Admin\AppData\Local\Temp\6B9C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\6C38.tmp"C:\Users\Admin\AppData\Local\Temp\6C38.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\6CC5.tmp"C:\Users\Admin\AppData\Local\Temp\6CC5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\6D61.tmp"C:\Users\Admin\AppData\Local\Temp\6D61.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\6DEE.tmp"C:\Users\Admin\AppData\Local\Temp\6DEE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\6E8A.tmp"C:\Users\Admin\AppData\Local\Temp\6E8A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\6F17.tmp"C:\Users\Admin\AppData\Local\Temp\6F17.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\6F94.tmp"C:\Users\Admin\AppData\Local\Temp\6F94.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\7168.tmp"C:\Users\Admin\AppData\Local\Temp\7168.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\734D.tmp"C:\Users\Admin\AppData\Local\Temp\734D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\7495.tmp"C:\Users\Admin\AppData\Local\Temp\7495.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\7550.tmp"C:\Users\Admin\AppData\Local\Temp\7550.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\75FC.tmp"C:\Users\Admin\AppData\Local\Temp\75FC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\76C7.tmp"C:\Users\Admin\AppData\Local\Temp\76C7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\7783.tmp"C:\Users\Admin\AppData\Local\Temp\7783.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\783E.tmp"C:\Users\Admin\AppData\Local\Temp\783E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\78AC.tmp"C:\Users\Admin\AppData\Local\Temp\78AC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7929.tmp"C:\Users\Admin\AppData\Local\Temp\7929.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\79C5.tmp"C:\Users\Admin\AppData\Local\Temp\79C5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\7A32.tmp"C:\Users\Admin\AppData\Local\Temp\7A32.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\7AAF.tmp"C:\Users\Admin\AppData\Local\Temp\7AAF.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\7B1D.tmp"C:\Users\Admin\AppData\Local\Temp\7B1D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\7B9A.tmp"C:\Users\Admin\AppData\Local\Temp\7B9A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\7C07.tmp"C:\Users\Admin\AppData\Local\Temp\7C07.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\7C75.tmp"C:\Users\Admin\AppData\Local\Temp\7C75.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\7CD2.tmp"C:\Users\Admin\AppData\Local\Temp\7CD2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\7D30.tmp"C:\Users\Admin\AppData\Local\Temp\7D30.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\7DAD.tmp"C:\Users\Admin\AppData\Local\Temp\7DAD.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\7E1A.tmp"C:\Users\Admin\AppData\Local\Temp\7E1A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\7E88.tmp"C:\Users\Admin\AppData\Local\Temp\7E88.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\7ED6.tmp"C:\Users\Admin\AppData\Local\Temp\7ED6.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\7F43.tmp"C:\Users\Admin\AppData\Local\Temp\7F43.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\7FD0.tmp"C:\Users\Admin\AppData\Local\Temp\7FD0.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\806C.tmp"C:\Users\Admin\AppData\Local\Temp\806C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\80E9.tmp"C:\Users\Admin\AppData\Local\Temp\80E9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\8166.tmp"C:\Users\Admin\AppData\Local\Temp\8166.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\81F3.tmp"C:\Users\Admin\AppData\Local\Temp\81F3.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\8251.tmp"C:\Users\Admin\AppData\Local\Temp\8251.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\82CE.tmp"C:\Users\Admin\AppData\Local\Temp\82CE.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\834B.tmp"C:\Users\Admin\AppData\Local\Temp\834B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\83B8.tmp"C:\Users\Admin\AppData\Local\Temp\83B8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\8435.tmp"C:\Users\Admin\AppData\Local\Temp\8435.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\84C2.tmp"C:\Users\Admin\AppData\Local\Temp\84C2.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\854E.tmp"C:\Users\Admin\AppData\Local\Temp\854E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\85DB.tmp"C:\Users\Admin\AppData\Local\Temp\85DB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\8658.tmp"C:\Users\Admin\AppData\Local\Temp\8658.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\86B6.tmp"C:\Users\Admin\AppData\Local\Temp\86B6.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\8713.tmp"C:\Users\Admin\AppData\Local\Temp\8713.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\8781.tmp"C:\Users\Admin\AppData\Local\Temp\8781.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\87EE.tmp"C:\Users\Admin\AppData\Local\Temp\87EE.tmp"65⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\885B.tmp"C:\Users\Admin\AppData\Local\Temp\885B.tmp"66⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\88D8.tmp"C:\Users\Admin\AppData\Local\Temp\88D8.tmp"67⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\8946.tmp"C:\Users\Admin\AppData\Local\Temp\8946.tmp"68⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\89C3.tmp"C:\Users\Admin\AppData\Local\Temp\89C3.tmp"69⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\8A40.tmp"C:\Users\Admin\AppData\Local\Temp\8A40.tmp"70⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\8AAD.tmp"C:\Users\Admin\AppData\Local\Temp\8AAD.tmp"71⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\8B2A.tmp"C:\Users\Admin\AppData\Local\Temp\8B2A.tmp"72⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\8B98.tmp"C:\Users\Admin\AppData\Local\Temp\8B98.tmp"73⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\8C05.tmp"C:\Users\Admin\AppData\Local\Temp\8C05.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\8C82.tmp"C:\Users\Admin\AppData\Local\Temp\8C82.tmp"75⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\8CE0.tmp"C:\Users\Admin\AppData\Local\Temp\8CE0.tmp"76⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\8D4D.tmp"C:\Users\Admin\AppData\Local\Temp\8D4D.tmp"77⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\8DDA.tmp"C:\Users\Admin\AppData\Local\Temp\8DDA.tmp"78⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\8E47.tmp"C:\Users\Admin\AppData\Local\Temp\8E47.tmp"79⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\8EB4.tmp"C:\Users\Admin\AppData\Local\Temp\8EB4.tmp"80⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\8F22.tmp"C:\Users\Admin\AppData\Local\Temp\8F22.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\8F9F.tmp"C:\Users\Admin\AppData\Local\Temp\8F9F.tmp"82⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\903B.tmp"C:\Users\Admin\AppData\Local\Temp\903B.tmp"83⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\9099.tmp"C:\Users\Admin\AppData\Local\Temp\9099.tmp"84⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\9116.tmp"C:\Users\Admin\AppData\Local\Temp\9116.tmp"85⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\91B2.tmp"C:\Users\Admin\AppData\Local\Temp\91B2.tmp"86⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\921F.tmp"C:\Users\Admin\AppData\Local\Temp\921F.tmp"87⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\927D.tmp"C:\Users\Admin\AppData\Local\Temp\927D.tmp"88⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\92FA.tmp"C:\Users\Admin\AppData\Local\Temp\92FA.tmp"89⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\9368.tmp"C:\Users\Admin\AppData\Local\Temp\9368.tmp"90⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\93D5.tmp"C:\Users\Admin\AppData\Local\Temp\93D5.tmp"91⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\9442.tmp"C:\Users\Admin\AppData\Local\Temp\9442.tmp"92⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\94BF.tmp"C:\Users\Admin\AppData\Local\Temp\94BF.tmp"93⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\952D.tmp"C:\Users\Admin\AppData\Local\Temp\952D.tmp"94⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\959A.tmp"C:\Users\Admin\AppData\Local\Temp\959A.tmp"95⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\9627.tmp"C:\Users\Admin\AppData\Local\Temp\9627.tmp"96⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\9694.tmp"C:\Users\Admin\AppData\Local\Temp\9694.tmp"97⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\9701.tmp"C:\Users\Admin\AppData\Local\Temp\9701.tmp"98⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\977E.tmp"C:\Users\Admin\AppData\Local\Temp\977E.tmp"99⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"100⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\9888.tmp"C:\Users\Admin\AppData\Local\Temp\9888.tmp"101⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"102⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9963.tmp"C:\Users\Admin\AppData\Local\Temp\9963.tmp"103⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\99D0.tmp"C:\Users\Admin\AppData\Local\Temp\99D0.tmp"104⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\9A3E.tmp"C:\Users\Admin\AppData\Local\Temp\9A3E.tmp"105⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\9AAB.tmp"C:\Users\Admin\AppData\Local\Temp\9AAB.tmp"106⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\9B28.tmp"C:\Users\Admin\AppData\Local\Temp\9B28.tmp"107⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\9BA5.tmp"C:\Users\Admin\AppData\Local\Temp\9BA5.tmp"108⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\9C12.tmp"C:\Users\Admin\AppData\Local\Temp\9C12.tmp"109⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\9C80.tmp"C:\Users\Admin\AppData\Local\Temp\9C80.tmp"110⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\9CDD.tmp"C:\Users\Admin\AppData\Local\Temp\9CDD.tmp"111⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\9D4B.tmp"C:\Users\Admin\AppData\Local\Temp\9D4B.tmp"112⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\9DA9.tmp"C:\Users\Admin\AppData\Local\Temp\9DA9.tmp"113⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\9E16.tmp"C:\Users\Admin\AppData\Local\Temp\9E16.tmp"114⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\9E83.tmp"C:\Users\Admin\AppData\Local\Temp\9E83.tmp"115⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\9F00.tmp"C:\Users\Admin\AppData\Local\Temp\9F00.tmp"116⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\9F6E.tmp"C:\Users\Admin\AppData\Local\Temp\9F6E.tmp"117⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\9FFA.tmp"C:\Users\Admin\AppData\Local\Temp\9FFA.tmp"118⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\A068.tmp"C:\Users\Admin\AppData\Local\Temp\A068.tmp"119⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\A0C5.tmp"C:\Users\Admin\AppData\Local\Temp\A0C5.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\A123.tmp"C:\Users\Admin\AppData\Local\Temp\A123.tmp"121⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\A191.tmp"C:\Users\Admin\AppData\Local\Temp\A191.tmp"122⤵PID:4840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-