Analysis
- max time kernel
129s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 22:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe
- Size 541KB
- Sample261027-2mlmmagv41
- SHA256 64a3129703bae847536282bb2d6e30202d3dfc3e8b9ec0d2cb22980cc1c14c3c
- MD5 eeb3094c462f7f72ba8f9ed64278c84f
- SHA1 3ab7faa9a16714af16176278d3998b8362ac29eb
- SHA512 9421a8060244c223f04f63888a3af802442993ce269bcbe67fbce7523c459353395dd042b906b1885bc2b839931afbc4d9d12fe05df552f78c49373f4d4ec8e1
- SSDEEP 12288:HU5rCOTeiJTfYDxmJ+RCErrliV1heDKkNZb73ctO:HUQOJJTfImTEroV10ekNV73ctO
- TLSH T181C4E126B544C232E28302711EDAEBA27A3E7C71572694C32BD4A27D2B757E0E375347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 400 1DAB.tmp 5672 1E47.tmp 2440 1F03.tmp 4148 200C.tmp 4936 20F7.tmp 2672 2183.tmp 1888 2220.tmp 2084 22CB.tmp 3336 2339.tmp 1340 23E5.tmp 4060 2491.tmp 4032 253C.tmp 460 25B9.tmp 3748 2646.tmp 3648 26C3.tmp 3692 276F.tmp 4216 282A.tmp 5696 28E6.tmp 5416 2982.tmp 5144 2A0F.tmp 2200 2ABB.tmp 4980 2B47.tmp 4876 2BC4.tmp 2512 2C9F.tmp 1544 2D2C.tmp 1812 2DC8.tmp 3140 2E64.tmp 2848 2F2F.tmp 6140 2FDB.tmp 2432 3058.tmp 4716 3104.tmp 6056 31B0.tmp 2116 324C.tmp 1616 32C9.tmp 3972 3346.tmp 4004 33B4.tmp 5732 3440.tmp 3444 34BD.tmp 5716 353A.tmp 1096 35B7.tmp 4740 3634.tmp 2340 36B1.tmp 1716 372E.tmp 5504 379C.tmp 3120 3828.tmp 2908 3896.tmp 2356 3922.tmp 3624 39AF.tmp 2924 3A3B.tmp 2348 3AD8.tmp 3948 3B64.tmp 1804 3BC2.tmp 1988 3C3F.tmp 1280 3CBC.tmp 4880 3D39.tmp 1916 3DA6.tmp 5336 3E33.tmp 4556 3EA0.tmp 5168 3F1D.tmp 4212 3F8B.tmp 4704 4017.tmp 4176 40A4.tmp 3176 4140.tmp 3252 41CD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F28F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6505.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 393D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F70E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 590E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C620.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3574.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4140.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D26F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E12A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B199.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 379C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D93B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4458.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 635A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6EB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 252 wrote to memory of 400 252 2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe 90 PID 400 wrote to memory of 5672 400 1DAB.tmp 91 PID 5672 wrote to memory of 2440 5672 1E47.tmp 92 PID 2440 wrote to memory of 4148 2440 1F03.tmp 93 PID 4148 wrote to memory of 4936 4148 200C.tmp 94 PID 4936 wrote to memory of 2672 4936 20F7.tmp 95 PID 2672 wrote to memory of 1888 2672 2183.tmp 96 PID 1888 wrote to memory of 2084 1888 2220.tmp 97 PID 2084 wrote to memory of 3336 2084 22CB.tmp 98 PID 3336 wrote to memory of 1340 3336 2339.tmp 99 PID 1340 wrote to memory of 4060 1340 23E5.tmp 100 PID 4060 wrote to memory of 4032 4060 2491.tmp 101 PID 4032 wrote to memory of 460 4032 253C.tmp 102 PID 460 wrote to memory of 3748 460 25B9.tmp 103 PID 3748 wrote to memory of 3648 3748 2646.tmp 104 PID 3648 wrote to memory of 3692 3648 26C3.tmp 105 PID 3692 wrote to memory of 4216 3692 276F.tmp 106 PID 4216 wrote to memory of 5696 4216 282A.tmp 107 PID 5696 wrote to memory of 5416 5696 28E6.tmp 108 PID 5416 wrote to memory of 5144 5416 2982.tmp 109 PID 5144 wrote to memory of 2200 5144 2A0F.tmp 110 PID 2200 wrote to memory of 4980 2200 2ABB.tmp 111 PID 4980 wrote to memory of 4876 4980 2B47.tmp 112 PID 4876 wrote to memory of 2512 4876 2BC4.tmp 113 PID 2512 wrote to memory of 1544 2512 2C9F.tmp 114 PID 1544 wrote to memory of 1812 1544 2D2C.tmp 115 PID 1812 wrote to memory of 3140 1812 2DC8.tmp 116 PID 3140 wrote to memory of 2848 3140 2E64.tmp 117 PID 2848 wrote to memory of 6140 2848 2F2F.tmp 118 PID 6140 wrote to memory of 2432 6140 2FDB.tmp 119 PID 2432 wrote to memory of 4716 2432 3058.tmp 120 PID 4716 wrote to memory of 6056 4716 3104.tmp 121 PID 6056 wrote to memory of 2116 6056 31B0.tmp 122 PID 2116 wrote to memory of 1616 2116 324C.tmp 123 PID 1616 wrote to memory of 3972 1616 32C9.tmp 124 PID 3972 wrote to memory of 4004 3972 3346.tmp 125 PID 4004 wrote to memory of 5732 4004 33B4.tmp 126 PID 5732 wrote to memory of 3444 5732 3440.tmp 127 PID 3444 wrote to memory of 5716 3444 34BD.tmp 128 PID 5716 wrote to memory of 1096 5716 353A.tmp 129 PID 1096 wrote to memory of 4740 1096 35B7.tmp 130 PID 4740 wrote to memory of 2340 4740 3634.tmp 131 PID 2340 wrote to memory of 1716 2340 36B1.tmp 132 PID 1716 wrote to memory of 5504 1716 372E.tmp 133 PID 5504 wrote to memory of 3120 5504 379C.tmp 134 PID 3120 wrote to memory of 2908 3120 3828.tmp 135 PID 2908 wrote to memory of 2356 2908 3896.tmp 137 PID 2356 wrote to memory of 3624 2356 3922.tmp 138 PID 3624 wrote to memory of 2924 3624 39AF.tmp 139 PID 2924 wrote to memory of 2348 2924 3A3B.tmp 140 PID 2348 wrote to memory of 3948 2348 3AD8.tmp 141 PID 3948 wrote to memory of 1804 3948 3B64.tmp 142 PID 1804 wrote to memory of 1988 1804 3BC2.tmp 143 PID 1988 wrote to memory of 1280 1988 3C3F.tmp 144 PID 1280 wrote to memory of 4880 1280 3CBC.tmp 145 PID 4880 wrote to memory of 1916 4880 3D39.tmp 146 PID 1916 wrote to memory of 5336 1916 3DA6.tmp 147 PID 5336 wrote to memory of 4556 5336 3E33.tmp 148 PID 4556 wrote to memory of 5168 4556 3EA0.tmp 149 PID 5168 wrote to memory of 4212 5168 3F1D.tmp 150 PID 4212 wrote to memory of 4704 4212 3F8B.tmp 151 PID 4704 wrote to memory of 4176 4704 4017.tmp 152 PID 4176 wrote to memory of 3176 4176 40A4.tmp 153 PID 3176 wrote to memory of 3252 3176 4140.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\1E47.tmp"C:\Users\Admin\AppData\Local\Temp\1E47.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\1F03.tmp"C:\Users\Admin\AppData\Local\Temp\1F03.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\200C.tmp"C:\Users\Admin\AppData\Local\Temp\200C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\20F7.tmp"C:\Users\Admin\AppData\Local\Temp\20F7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\2183.tmp"C:\Users\Admin\AppData\Local\Temp\2183.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\2220.tmp"C:\Users\Admin\AppData\Local\Temp\2220.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\22CB.tmp"C:\Users\Admin\AppData\Local\Temp\22CB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\2339.tmp"C:\Users\Admin\AppData\Local\Temp\2339.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\26C3.tmp"C:\Users\Admin\AppData\Local\Temp\26C3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\276F.tmp"C:\Users\Admin\AppData\Local\Temp\276F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\282A.tmp"C:\Users\Admin\AppData\Local\Temp\282A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\28E6.tmp"C:\Users\Admin\AppData\Local\Temp\28E6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\2982.tmp"C:\Users\Admin\AppData\Local\Temp\2982.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\2ABB.tmp"C:\Users\Admin\AppData\Local\Temp\2ABB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2B47.tmp"C:\Users\Admin\AppData\Local\Temp\2B47.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\2C9F.tmp"C:\Users\Admin\AppData\Local\Temp\2C9F.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\2D2C.tmp"C:\Users\Admin\AppData\Local\Temp\2D2C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\2E64.tmp"C:\Users\Admin\AppData\Local\Temp\2E64.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\2FDB.tmp"C:\Users\Admin\AppData\Local\Temp\2FDB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\3058.tmp"C:\Users\Admin\AppData\Local\Temp\3058.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3104.tmp"C:\Users\Admin\AppData\Local\Temp\3104.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\31B0.tmp"C:\Users\Admin\AppData\Local\Temp\31B0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\324C.tmp"C:\Users\Admin\AppData\Local\Temp\324C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\32C9.tmp"C:\Users\Admin\AppData\Local\Temp\32C9.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3346.tmp"C:\Users\Admin\AppData\Local\Temp\3346.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\33B4.tmp"C:\Users\Admin\AppData\Local\Temp\33B4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\3440.tmp"C:\Users\Admin\AppData\Local\Temp\3440.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\34BD.tmp"C:\Users\Admin\AppData\Local\Temp\34BD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\353A.tmp"C:\Users\Admin\AppData\Local\Temp\353A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\35B7.tmp"C:\Users\Admin\AppData\Local\Temp\35B7.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\3634.tmp"C:\Users\Admin\AppData\Local\Temp\3634.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\36B1.tmp"C:\Users\Admin\AppData\Local\Temp\36B1.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\372E.tmp"C:\Users\Admin\AppData\Local\Temp\372E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\379C.tmp"C:\Users\Admin\AppData\Local\Temp\379C.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\3828.tmp"C:\Users\Admin\AppData\Local\Temp\3828.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\3896.tmp"C:\Users\Admin\AppData\Local\Temp\3896.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\3922.tmp"C:\Users\Admin\AppData\Local\Temp\3922.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\39AF.tmp"C:\Users\Admin\AppData\Local\Temp\39AF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\3A3B.tmp"C:\Users\Admin\AppData\Local\Temp\3A3B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3AD8.tmp"C:\Users\Admin\AppData\Local\Temp\3AD8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\3B64.tmp"C:\Users\Admin\AppData\Local\Temp\3B64.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\3BC2.tmp"C:\Users\Admin\AppData\Local\Temp\3BC2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\3C3F.tmp"C:\Users\Admin\AppData\Local\Temp\3C3F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3CBC.tmp"C:\Users\Admin\AppData\Local\Temp\3CBC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\3D39.tmp"C:\Users\Admin\AppData\Local\Temp\3D39.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\3DA6.tmp"C:\Users\Admin\AppData\Local\Temp\3DA6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\3E33.tmp"C:\Users\Admin\AppData\Local\Temp\3E33.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\3EA0.tmp"C:\Users\Admin\AppData\Local\Temp\3EA0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\3F8B.tmp"C:\Users\Admin\AppData\Local\Temp\3F8B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\4017.tmp"C:\Users\Admin\AppData\Local\Temp\4017.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\40A4.tmp"C:\Users\Admin\AppData\Local\Temp\40A4.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\4140.tmp"C:\Users\Admin\AppData\Local\Temp\4140.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\41CD.tmp"C:\Users\Admin\AppData\Local\Temp\41CD.tmp"65⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\425A.tmp"C:\Users\Admin\AppData\Local\Temp\425A.tmp"66⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\42C7.tmp"C:\Users\Admin\AppData\Local\Temp\42C7.tmp"67⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\4344.tmp"C:\Users\Admin\AppData\Local\Temp\4344.tmp"68⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\43C1.tmp"C:\Users\Admin\AppData\Local\Temp\43C1.tmp"69⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\443E.tmp"C:\Users\Admin\AppData\Local\Temp\443E.tmp"70⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\44BB.tmp"C:\Users\Admin\AppData\Local\Temp\44BB.tmp"71⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\4528.tmp"C:\Users\Admin\AppData\Local\Temp\4528.tmp"72⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\4596.tmp"C:\Users\Admin\AppData\Local\Temp\4596.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\4613.tmp"C:\Users\Admin\AppData\Local\Temp\4613.tmp"74⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\4690.tmp"C:\Users\Admin\AppData\Local\Temp\4690.tmp"75⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\470D.tmp"C:\Users\Admin\AppData\Local\Temp\470D.tmp"76⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\4799.tmp"C:\Users\Admin\AppData\Local\Temp\4799.tmp"77⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\4807.tmp"C:\Users\Admin\AppData\Local\Temp\4807.tmp"78⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\4874.tmp"C:\Users\Admin\AppData\Local\Temp\4874.tmp"79⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\48F1.tmp"C:\Users\Admin\AppData\Local\Temp\48F1.tmp"80⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\496E.tmp"C:\Users\Admin\AppData\Local\Temp\496E.tmp"81⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\49DB.tmp"C:\Users\Admin\AppData\Local\Temp\49DB.tmp"82⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\4A87.tmp"C:\Users\Admin\AppData\Local\Temp\4A87.tmp"83⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"84⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"85⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"86⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\4C6C.tmp"C:\Users\Admin\AppData\Local\Temp\4C6C.tmp"87⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"88⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\4D66.tmp"C:\Users\Admin\AppData\Local\Temp\4D66.tmp"89⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\4DF2.tmp"C:\Users\Admin\AppData\Local\Temp\4DF2.tmp"90⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\4E50.tmp"C:\Users\Admin\AppData\Local\Temp\4E50.tmp"91⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\4EDD.tmp"C:\Users\Admin\AppData\Local\Temp\4EDD.tmp"92⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\4F4A.tmp"C:\Users\Admin\AppData\Local\Temp\4F4A.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\4FB7.tmp"C:\Users\Admin\AppData\Local\Temp\4FB7.tmp"94⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\5025.tmp"C:\Users\Admin\AppData\Local\Temp\5025.tmp"95⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\5083.tmp"C:\Users\Admin\AppData\Local\Temp\5083.tmp"96⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\510F.tmp"C:\Users\Admin\AppData\Local\Temp\510F.tmp"97⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\518C.tmp"C:\Users\Admin\AppData\Local\Temp\518C.tmp"98⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\51FA.tmp"C:\Users\Admin\AppData\Local\Temp\51FA.tmp"99⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\5267.tmp"C:\Users\Admin\AppData\Local\Temp\5267.tmp"100⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\52D4.tmp"C:\Users\Admin\AppData\Local\Temp\52D4.tmp"101⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\5351.tmp"C:\Users\Admin\AppData\Local\Temp\5351.tmp"102⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\53DE.tmp"C:\Users\Admin\AppData\Local\Temp\53DE.tmp"103⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\545B.tmp"C:\Users\Admin\AppData\Local\Temp\545B.tmp"104⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\54C8.tmp"C:\Users\Admin\AppData\Local\Temp\54C8.tmp"105⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\5545.tmp"C:\Users\Admin\AppData\Local\Temp\5545.tmp"106⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\55C2.tmp"C:\Users\Admin\AppData\Local\Temp\55C2.tmp"107⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\563F.tmp"C:\Users\Admin\AppData\Local\Temp\563F.tmp"108⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\56BC.tmp"C:\Users\Admin\AppData\Local\Temp\56BC.tmp"109⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\5739.tmp"C:\Users\Admin\AppData\Local\Temp\5739.tmp"110⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\57A7.tmp"C:\Users\Admin\AppData\Local\Temp\57A7.tmp"111⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\5814.tmp"C:\Users\Admin\AppData\Local\Temp\5814.tmp"112⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\5891.tmp"C:\Users\Admin\AppData\Local\Temp\5891.tmp"113⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\590E.tmp"C:\Users\Admin\AppData\Local\Temp\590E.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\597B.tmp"C:\Users\Admin\AppData\Local\Temp\597B.tmp"115⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\59E9.tmp"C:\Users\Admin\AppData\Local\Temp\59E9.tmp"116⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5A75.tmp"C:\Users\Admin\AppData\Local\Temp\5A75.tmp"117⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\5AF2.tmp"C:\Users\Admin\AppData\Local\Temp\5AF2.tmp"118⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\5B6F.tmp"C:\Users\Admin\AppData\Local\Temp\5B6F.tmp"119⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\5BEC.tmp"C:\Users\Admin\AppData\Local\Temp\5BEC.tmp"120⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\5C5A.tmp"C:\Users\Admin\AppData\Local\Temp\5C5A.tmp"121⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\5CD7.tmp"C:\Users\Admin\AppData\Local\Temp\5CD7.tmp"122⤵PID:356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-