Analysis
- max time kernel
123s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 02:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_f7d2fc4511359059f6a738f90dd23dbf_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_f7d2fc4511359059f6a738f90dd23dbf_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-01_f7d2fc4511359059f6a738f90dd23dbf_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample261102-c3bd6a118j
- SHA256 ee5da6fa37eddd168d678bd324146696080b194b48919a34fb019071ad00f813
- MD5 f7d2fc4511359059f6a738f90dd23dbf
- SHA1 5490f74f3f98d1910a737435aa7986fd864f8c97
- SHA512 b191256cfbc1d55284f7ce1f61309a947cf20ed837d65cb91cc8387bfedef24b29208b5be8f2bef95ea9a8c81e9042594648ab5dac30c51fda52d789aee4f92a
- SSDEEP 12288:yU5rCOTeiNAHrsfut0RZOLf6Tcz9coDbZ:yUQOJNErrt7LSo9coDb
- TLSH T1DCB4F125B584C032E5D312310EE6EBB1293BBD755B2194C76B90A7BE2EB12E1D778307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1496 1DCA.tmp 4540 1E47.tmp 4704 1F70.tmp 5948 206A.tmp 3244 2116.tmp 4600 2193.tmp 4256 226E.tmp 5304 22EB.tmp 1164 2387.tmp 2336 2414.tmp 5400 24B0.tmp 4888 253C.tmp 5260 25B9.tmp 4084 2675.tmp 4196 2711.tmp 5792 27BD.tmp 4496 2859.tmp 924 28E6.tmp 1092 2982.tmp 3732 2A3E.tmp 4612 2A8C.tmp 5988 2B47.tmp 5532 2C12.tmp 6132 2CAF.tmp 5424 2D6A.tmp 6128 2DE7.tmp 5452 2EC2.tmp 560 2F3F.tmp 1732 2FBC.tmp 1224 3058.tmp 4036 3114.tmp 2796 31C0.tmp 1556 327B.tmp 2008 32F8.tmp 1740 3365.tmp 6120 33F2.tmp 5348 347F.tmp 6064 34EC.tmp 5436 3559.tmp 4016 35B7.tmp 4788 3625.tmp 1984 36C1.tmp 952 372E.tmp 4848 37AB.tmp 1844 3828.tmp 1240 38A5.tmp 2004 3922.tmp 4564 399F.tmp 5372 3A0D.tmp 3864 3A7A.tmp 3476 3B07.tmp 4988 3B93.tmp 5328 3C10.tmp 1288 3C8D.tmp 904 3CFB.tmp 6076 3D78.tmp 5320 3DD5.tmp 3584 3E52.tmp 5168 3ECF.tmp 4852 3F4C.tmp 3212 3FAA.tmp 3332 4017.tmp 3144 40B4.tmp 4588 4131.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5437.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B14B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D454.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 947C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F355.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 921F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2547.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 930A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3058.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 803D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 800A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B429.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F624.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 631B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 584E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 1496 2888 2026-11-01_f7d2fc4511359059f6a738f90dd23dbf_elex_mafia_stealc_tofsee.exe 90 PID 1496 wrote to memory of 4540 1496 1DCA.tmp 91 PID 4540 wrote to memory of 4704 4540 1E47.tmp 92 PID 4704 wrote to memory of 5948 4704 1F70.tmp 93 PID 5948 wrote to memory of 3244 5948 206A.tmp 94 PID 3244 wrote to memory of 4600 3244 2116.tmp 95 PID 4600 wrote to memory of 4256 4600 2193.tmp 96 PID 4256 wrote to memory of 5304 4256 226E.tmp 97 PID 5304 wrote to memory of 1164 5304 22EB.tmp 98 PID 1164 wrote to memory of 2336 1164 2387.tmp 99 PID 2336 wrote to memory of 5400 2336 2414.tmp 100 PID 5400 wrote to memory of 4888 5400 24B0.tmp 101 PID 4888 wrote to memory of 5260 4888 253C.tmp 102 PID 5260 wrote to memory of 4084 5260 25B9.tmp 103 PID 4084 wrote to memory of 4196 4084 2675.tmp 104 PID 4196 wrote to memory of 5792 4196 2711.tmp 105 PID 5792 wrote to memory of 4496 5792 27BD.tmp 106 PID 4496 wrote to memory of 924 4496 2859.tmp 107 PID 924 wrote to memory of 1092 924 28E6.tmp 108 PID 1092 wrote to memory of 3732 1092 2982.tmp 109 PID 3732 wrote to memory of 4612 3732 2A3E.tmp 110 PID 4612 wrote to memory of 5988 4612 2A8C.tmp 111 PID 5988 wrote to memory of 5532 5988 2B47.tmp 112 PID 5532 wrote to memory of 6132 5532 2C12.tmp 113 PID 6132 wrote to memory of 5424 6132 2CAF.tmp 114 PID 5424 wrote to memory of 6128 5424 2D6A.tmp 115 PID 6128 wrote to memory of 5452 6128 2DE7.tmp 116 PID 5452 wrote to memory of 560 5452 2EC2.tmp 117 PID 560 wrote to memory of 1732 560 2F3F.tmp 118 PID 1732 wrote to memory of 1224 1732 2FBC.tmp 119 PID 1224 wrote to memory of 4036 1224 3058.tmp 120 PID 4036 wrote to memory of 2796 4036 3114.tmp 121 PID 2796 wrote to memory of 1556 2796 31C0.tmp 122 PID 1556 wrote to memory of 2008 1556 327B.tmp 123 PID 2008 wrote to memory of 1740 2008 32F8.tmp 124 PID 1740 wrote to memory of 6120 1740 3365.tmp 125 PID 6120 wrote to memory of 5348 6120 33F2.tmp 126 PID 5348 wrote to memory of 6064 5348 347F.tmp 127 PID 6064 wrote to memory of 5436 6064 34EC.tmp 128 PID 5436 wrote to memory of 4016 5436 3559.tmp 129 PID 4016 wrote to memory of 4788 4016 35B7.tmp 130 PID 4788 wrote to memory of 1984 4788 3625.tmp 131 PID 1984 wrote to memory of 952 1984 36C1.tmp 132 PID 952 wrote to memory of 4848 952 372E.tmp 133 PID 4848 wrote to memory of 1844 4848 37AB.tmp 134 PID 1844 wrote to memory of 1240 1844 3828.tmp 135 PID 1240 wrote to memory of 2004 1240 38A5.tmp 136 PID 2004 wrote to memory of 4564 2004 3922.tmp 138 PID 4564 wrote to memory of 5372 4564 399F.tmp 139 PID 5372 wrote to memory of 3864 5372 3A0D.tmp 140 PID 3864 wrote to memory of 3476 3864 3A7A.tmp 141 PID 3476 wrote to memory of 4988 3476 3B07.tmp 142 PID 4988 wrote to memory of 5328 4988 3B93.tmp 143 PID 5328 wrote to memory of 1288 5328 3C10.tmp 144 PID 1288 wrote to memory of 904 1288 3C8D.tmp 145 PID 904 wrote to memory of 6076 904 3CFB.tmp 146 PID 6076 wrote to memory of 5320 6076 3D78.tmp 147 PID 5320 wrote to memory of 3584 5320 3DD5.tmp 148 PID 3584 wrote to memory of 5168 3584 3E52.tmp 149 PID 5168 wrote to memory of 4852 5168 3ECF.tmp 150 PID 4852 wrote to memory of 3212 4852 3F4C.tmp 151 PID 3212 wrote to memory of 3332 3212 3FAA.tmp 152 PID 3332 wrote to memory of 3144 3332 4017.tmp 153 PID 3144 wrote to memory of 4588 3144 40B4.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_f7d2fc4511359059f6a738f90dd23dbf_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f7d2fc4511359059f6a738f90dd23dbf_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\1E47.tmp"C:\Users\Admin\AppData\Local\Temp\1E47.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\1F70.tmp"C:\Users\Admin\AppData\Local\Temp\1F70.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\206A.tmp"C:\Users\Admin\AppData\Local\Temp\206A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\2116.tmp"C:\Users\Admin\AppData\Local\Temp\2116.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\2193.tmp"C:\Users\Admin\AppData\Local\Temp\2193.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\226E.tmp"C:\Users\Admin\AppData\Local\Temp\226E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\22EB.tmp"C:\Users\Admin\AppData\Local\Temp\22EB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\2387.tmp"C:\Users\Admin\AppData\Local\Temp\2387.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\2675.tmp"C:\Users\Admin\AppData\Local\Temp\2675.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\2711.tmp"C:\Users\Admin\AppData\Local\Temp\2711.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\27BD.tmp"C:\Users\Admin\AppData\Local\Temp\27BD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\2859.tmp"C:\Users\Admin\AppData\Local\Temp\2859.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\28E6.tmp"C:\Users\Admin\AppData\Local\Temp\28E6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\2982.tmp"C:\Users\Admin\AppData\Local\Temp\2982.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\2B47.tmp"C:\Users\Admin\AppData\Local\Temp\2B47.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\2C12.tmp"C:\Users\Admin\AppData\Local\Temp\2C12.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\2CAF.tmp"C:\Users\Admin\AppData\Local\Temp\2CAF.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\2F3F.tmp"C:\Users\Admin\AppData\Local\Temp\2F3F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\3058.tmp"C:\Users\Admin\AppData\Local\Temp\3058.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3114.tmp"C:\Users\Admin\AppData\Local\Temp\3114.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\31C0.tmp"C:\Users\Admin\AppData\Local\Temp\31C0.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\327B.tmp"C:\Users\Admin\AppData\Local\Temp\327B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\32F8.tmp"C:\Users\Admin\AppData\Local\Temp\32F8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3365.tmp"C:\Users\Admin\AppData\Local\Temp\3365.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\33F2.tmp"C:\Users\Admin\AppData\Local\Temp\33F2.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\347F.tmp"C:\Users\Admin\AppData\Local\Temp\347F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\34EC.tmp"C:\Users\Admin\AppData\Local\Temp\34EC.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\3559.tmp"C:\Users\Admin\AppData\Local\Temp\3559.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\35B7.tmp"C:\Users\Admin\AppData\Local\Temp\35B7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\3625.tmp"C:\Users\Admin\AppData\Local\Temp\3625.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\36C1.tmp"C:\Users\Admin\AppData\Local\Temp\36C1.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\372E.tmp"C:\Users\Admin\AppData\Local\Temp\372E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\37AB.tmp"C:\Users\Admin\AppData\Local\Temp\37AB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\3828.tmp"C:\Users\Admin\AppData\Local\Temp\3828.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\38A5.tmp"C:\Users\Admin\AppData\Local\Temp\38A5.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\3922.tmp"C:\Users\Admin\AppData\Local\Temp\3922.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\399F.tmp"C:\Users\Admin\AppData\Local\Temp\399F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\3A0D.tmp"C:\Users\Admin\AppData\Local\Temp\3A0D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\3A7A.tmp"C:\Users\Admin\AppData\Local\Temp\3A7A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\3B07.tmp"C:\Users\Admin\AppData\Local\Temp\3B07.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\3B93.tmp"C:\Users\Admin\AppData\Local\Temp\3B93.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\3C10.tmp"C:\Users\Admin\AppData\Local\Temp\3C10.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\3C8D.tmp"C:\Users\Admin\AppData\Local\Temp\3C8D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\3CFB.tmp"C:\Users\Admin\AppData\Local\Temp\3CFB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\3D78.tmp"C:\Users\Admin\AppData\Local\Temp\3D78.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\3DD5.tmp"C:\Users\Admin\AppData\Local\Temp\3DD5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\3E52.tmp"C:\Users\Admin\AppData\Local\Temp\3E52.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\3ECF.tmp"C:\Users\Admin\AppData\Local\Temp\3ECF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\3F4C.tmp"C:\Users\Admin\AppData\Local\Temp\3F4C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\3FAA.tmp"C:\Users\Admin\AppData\Local\Temp\3FAA.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\4017.tmp"C:\Users\Admin\AppData\Local\Temp\4017.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\40B4.tmp"C:\Users\Admin\AppData\Local\Temp\40B4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\4131.tmp"C:\Users\Admin\AppData\Local\Temp\4131.tmp"65⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\419E.tmp"C:\Users\Admin\AppData\Local\Temp\419E.tmp"66⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\420B.tmp"C:\Users\Admin\AppData\Local\Temp\420B.tmp"67⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\4288.tmp"C:\Users\Admin\AppData\Local\Temp\4288.tmp"68⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\4315.tmp"C:\Users\Admin\AppData\Local\Temp\4315.tmp"69⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\4373.tmp"C:\Users\Admin\AppData\Local\Temp\4373.tmp"70⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\43FF.tmp"C:\Users\Admin\AppData\Local\Temp\43FF.tmp"71⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\447C.tmp"C:\Users\Admin\AppData\Local\Temp\447C.tmp"72⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\44DA.tmp"C:\Users\Admin\AppData\Local\Temp\44DA.tmp"73⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\4567.tmp"C:\Users\Admin\AppData\Local\Temp\4567.tmp"74⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\45D4.tmp"C:\Users\Admin\AppData\Local\Temp\45D4.tmp"75⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\4642.tmp"C:\Users\Admin\AppData\Local\Temp\4642.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\46AF.tmp"C:\Users\Admin\AppData\Local\Temp\46AF.tmp"77⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\472C.tmp"C:\Users\Admin\AppData\Local\Temp\472C.tmp"78⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\47A9.tmp"C:\Users\Admin\AppData\Local\Temp\47A9.tmp"79⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\4826.tmp"C:\Users\Admin\AppData\Local\Temp\4826.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\48B3.tmp"C:\Users\Admin\AppData\Local\Temp\48B3.tmp"81⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\494F.tmp"C:\Users\Admin\AppData\Local\Temp\494F.tmp"82⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\49BC.tmp"C:\Users\Admin\AppData\Local\Temp\49BC.tmp"83⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\4A49.tmp"C:\Users\Admin\AppData\Local\Temp\4A49.tmp"84⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"85⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"86⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"87⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"89⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\4D66.tmp"C:\Users\Admin\AppData\Local\Temp\4D66.tmp"90⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\4DE3.tmp"C:\Users\Admin\AppData\Local\Temp\4DE3.tmp"91⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\4E50.tmp"C:\Users\Admin\AppData\Local\Temp\4E50.tmp"92⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\4ECD.tmp"C:\Users\Admin\AppData\Local\Temp\4ECD.tmp"93⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\4F3A.tmp"C:\Users\Admin\AppData\Local\Temp\4F3A.tmp"94⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\4FB7.tmp"C:\Users\Admin\AppData\Local\Temp\4FB7.tmp"95⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\5025.tmp"C:\Users\Admin\AppData\Local\Temp\5025.tmp"96⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\50B1.tmp"C:\Users\Admin\AppData\Local\Temp\50B1.tmp"97⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\510F.tmp"C:\Users\Admin\AppData\Local\Temp\510F.tmp"98⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\518C.tmp"C:\Users\Admin\AppData\Local\Temp\518C.tmp"99⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\5209.tmp"C:\Users\Admin\AppData\Local\Temp\5209.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\5296.tmp"C:\Users\Admin\AppData\Local\Temp\5296.tmp"101⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\5303.tmp"C:\Users\Admin\AppData\Local\Temp\5303.tmp"102⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\5380.tmp"C:\Users\Admin\AppData\Local\Temp\5380.tmp"103⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\541C.tmp"C:\Users\Admin\AppData\Local\Temp\541C.tmp"104⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\54A9.tmp"C:\Users\Admin\AppData\Local\Temp\54A9.tmp"105⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\5526.tmp"C:\Users\Admin\AppData\Local\Temp\5526.tmp"106⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\5593.tmp"C:\Users\Admin\AppData\Local\Temp\5593.tmp"107⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\5610.tmp"C:\Users\Admin\AppData\Local\Temp\5610.tmp"108⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\56AD.tmp"C:\Users\Admin\AppData\Local\Temp\56AD.tmp"109⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\571A.tmp"C:\Users\Admin\AppData\Local\Temp\571A.tmp"110⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\5797.tmp"C:\Users\Admin\AppData\Local\Temp\5797.tmp"111⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\5804.tmp"C:\Users\Admin\AppData\Local\Temp\5804.tmp"112⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\5872.tmp"C:\Users\Admin\AppData\Local\Temp\5872.tmp"113⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\58FE.tmp"C:\Users\Admin\AppData\Local\Temp\58FE.tmp"114⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\597B.tmp"C:\Users\Admin\AppData\Local\Temp\597B.tmp"115⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\59F8.tmp"C:\Users\Admin\AppData\Local\Temp\59F8.tmp"116⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\5A75.tmp"C:\Users\Admin\AppData\Local\Temp\5A75.tmp"117⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\5B21.tmp"C:\Users\Admin\AppData\Local\Temp\5B21.tmp"118⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\5BBE.tmp"C:\Users\Admin\AppData\Local\Temp\5BBE.tmp"119⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\5C2B.tmp"C:\Users\Admin\AppData\Local\Temp\5C2B.tmp"120⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\5CE6.tmp"C:\Users\Admin\AppData\Local\Temp\5CE6.tmp"121⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\5D92.tmp"C:\Users\Admin\AppData\Local\Temp\5D92.tmp"122⤵PID:356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-