Analysis
- max time kernel
123s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 16:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_7756b66d301ac9addcaa56a5a9ee9f97_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_7756b66d301ac9addcaa56a5a9ee9f97_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-03_7756b66d301ac9addcaa56a5a9ee9f97_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample261104-t3mkvsdz8j
- SHA256 cf19e7cd5a838ed9ee2f37ea730e06c6749df4740afb4b68d3cde4f4394df228
- MD5 7756b66d301ac9addcaa56a5a9ee9f97
- SHA1 5d831834b58c04e58495b299d0e5f86a1ff81401
- SHA512 d8a204fd1254d1ac757a16c366259ed9687e87e07d47f93793e87f399d8fb3551be80fc4ce15fb425d464db21cd713450eba6d3fed6c8368ba8965151be5e45b
- SSDEEP 12288:wU5rCOTeiDHuuMx9DboczK/4Ee6q/YfMNZ+3/v+I9hUG2VA:wUQOJDm9XomK7q4MNGEA
- TLSH T125E4E02173D88532E5FB037859B5E6614D7EFD226722D6CF2F8052AE09B1BC08A71727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4920 7D30.tmp 3144 7DBD.tmp 5464 7E49.tmp 3304 7EB7.tmp 4416 805D.tmp 620 8118.tmp 2588 8231.tmp 2136 831C.tmp 3220 83F6.tmp 4192 84D1.tmp 2600 85AC.tmp 3412 8713.tmp 5848 887B.tmp 4508 8984.tmp 4996 8A4F.tmp 3192 8B69.tmp 4100 8C43.tmp 3100 8D5D.tmp 2280 8E95.tmp 5892 8F8F.tmp 2572 9099.tmp 4724 91A2.tmp 2468 927D.tmp 124 93E5.tmp 1192 94EE.tmp 1216 95F8.tmp 2012 96D3.tmp 5444 97BD.tmp 2444 9888.tmp 5740 99C1.tmp 4660 9ADA.tmp 5144 9C03.tmp 5020 9D1C.tmp 1564 9DE7.tmp 5068 9E74.tmp 1972 9F10.tmp 1596 9FEB.tmp 5392 A087.tmp 2800 A114.tmp 972 A1DF.tmp 3448 A25C.tmp 1160 A317.tmp 2892 A3D3.tmp 4480 A4AD.tmp 4516 A579.tmp 4820 A634.tmp 2616 A6FF.tmp 1880 A79B.tmp 908 A857.tmp 1836 A8F3.tmp 4640 A980.tmp 684 AA0C.tmp 5916 AA7A.tmp 2324 AAE7.tmp 4948 AB74.tmp 4988 AC00.tmp 3696 AC8D.tmp 3156 AD1A.tmp 5640 ADA6.tmp 1108 AE33.tmp 4824 AECF.tmp 1068 AF6B.tmp 1280 AFE8.tmp 4904 B085.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D67B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2821.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C390.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F713.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1605.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E868.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A729.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5943.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D071.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D86F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 412C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B288.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 319C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E04F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C60C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 339F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7348.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB5D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5096 wrote to memory of 4920 5096 2026-11-03_7756b66d301ac9addcaa56a5a9ee9f97_elex_mafia_stealc_tofsee.exe 89 PID 4920 wrote to memory of 3144 4920 7D30.tmp 90 PID 3144 wrote to memory of 5464 3144 7DBD.tmp 91 PID 5464 wrote to memory of 3304 5464 7E49.tmp 92 PID 3304 wrote to memory of 4416 3304 7EB7.tmp 93 PID 4416 wrote to memory of 620 4416 805D.tmp 94 PID 620 wrote to memory of 2588 620 8118.tmp 95 PID 2588 wrote to memory of 2136 2588 8231.tmp 96 PID 2136 wrote to memory of 3220 2136 831C.tmp 97 PID 3220 wrote to memory of 4192 3220 83F6.tmp 98 PID 4192 wrote to memory of 2600 4192 84D1.tmp 99 PID 2600 wrote to memory of 3412 2600 85AC.tmp 100 PID 3412 wrote to memory of 5848 3412 8713.tmp 101 PID 5848 wrote to memory of 4508 5848 887B.tmp 102 PID 4508 wrote to memory of 4996 4508 8984.tmp 103 PID 4996 wrote to memory of 3192 4996 8A4F.tmp 104 PID 3192 wrote to memory of 4100 3192 8B69.tmp 105 PID 4100 wrote to memory of 3100 4100 8C43.tmp 106 PID 3100 wrote to memory of 2280 3100 8D5D.tmp 107 PID 2280 wrote to memory of 5892 2280 8E95.tmp 108 PID 5892 wrote to memory of 2572 5892 8F8F.tmp 109 PID 2572 wrote to memory of 4724 2572 9099.tmp 110 PID 4724 wrote to memory of 2468 4724 91A2.tmp 111 PID 2468 wrote to memory of 124 2468 927D.tmp 112 PID 124 wrote to memory of 1192 124 93E5.tmp 113 PID 1192 wrote to memory of 1216 1192 94EE.tmp 114 PID 1216 wrote to memory of 2012 1216 95F8.tmp 115 PID 2012 wrote to memory of 5444 2012 96D3.tmp 116 PID 5444 wrote to memory of 2444 5444 97BD.tmp 117 PID 2444 wrote to memory of 5740 2444 9888.tmp 118 PID 5740 wrote to memory of 4660 5740 99C1.tmp 119 PID 4660 wrote to memory of 5144 4660 9ADA.tmp 120 PID 5144 wrote to memory of 5020 5144 9C03.tmp 121 PID 5020 wrote to memory of 1564 5020 9D1C.tmp 122 PID 1564 wrote to memory of 5068 1564 9DE7.tmp 123 PID 5068 wrote to memory of 1972 5068 9E74.tmp 124 PID 1972 wrote to memory of 1596 1972 9F10.tmp 125 PID 1596 wrote to memory of 5392 1596 9FEB.tmp 126 PID 5392 wrote to memory of 2800 5392 A087.tmp 127 PID 2800 wrote to memory of 972 2800 A114.tmp 128 PID 972 wrote to memory of 3448 972 A1DF.tmp 129 PID 3448 wrote to memory of 1160 3448 A25C.tmp 130 PID 1160 wrote to memory of 2892 1160 A317.tmp 131 PID 2892 wrote to memory of 4480 2892 A3D3.tmp 132 PID 4480 wrote to memory of 4516 4480 A4AD.tmp 133 PID 4516 wrote to memory of 4820 4516 A579.tmp 134 PID 4820 wrote to memory of 2616 4820 A634.tmp 135 PID 2616 wrote to memory of 1880 2616 A6FF.tmp 136 PID 1880 wrote to memory of 908 1880 A79B.tmp 137 PID 908 wrote to memory of 1836 908 A857.tmp 138 PID 1836 wrote to memory of 4640 1836 A8F3.tmp 139 PID 4640 wrote to memory of 684 4640 A980.tmp 140 PID 684 wrote to memory of 5916 684 AA0C.tmp 141 PID 5916 wrote to memory of 2324 5916 AA7A.tmp 142 PID 2324 wrote to memory of 4948 2324 AAE7.tmp 143 PID 4948 wrote to memory of 4988 4948 AB74.tmp 144 PID 4988 wrote to memory of 3696 4988 AC00.tmp 145 PID 3696 wrote to memory of 3156 3696 AC8D.tmp 146 PID 3156 wrote to memory of 5640 3156 AD1A.tmp 147 PID 5640 wrote to memory of 1108 5640 ADA6.tmp 148 PID 1108 wrote to memory of 4824 1108 AE33.tmp 149 PID 4824 wrote to memory of 1068 4824 AECF.tmp 150 PID 1068 wrote to memory of 1280 1068 AF6B.tmp 151 PID 1280 wrote to memory of 4904 1280 AFE8.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_7756b66d301ac9addcaa56a5a9ee9f97_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_7756b66d301ac9addcaa56a5a9ee9f97_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\7D30.tmp"C:\Users\Admin\AppData\Local\Temp\7D30.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\7E49.tmp"C:\Users\Admin\AppData\Local\Temp\7E49.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\805D.tmp"C:\Users\Admin\AppData\Local\Temp\805D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\8118.tmp"C:\Users\Admin\AppData\Local\Temp\8118.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\8231.tmp"C:\Users\Admin\AppData\Local\Temp\8231.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\831C.tmp"C:\Users\Admin\AppData\Local\Temp\831C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\83F6.tmp"C:\Users\Admin\AppData\Local\Temp\83F6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\84D1.tmp"C:\Users\Admin\AppData\Local\Temp\84D1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\85AC.tmp"C:\Users\Admin\AppData\Local\Temp\85AC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8713.tmp"C:\Users\Admin\AppData\Local\Temp\8713.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\887B.tmp"C:\Users\Admin\AppData\Local\Temp\887B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\8984.tmp"C:\Users\Admin\AppData\Local\Temp\8984.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\8A4F.tmp"C:\Users\Admin\AppData\Local\Temp\8A4F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\8B69.tmp"C:\Users\Admin\AppData\Local\Temp\8B69.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\8C43.tmp"C:\Users\Admin\AppData\Local\Temp\8C43.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\8D5D.tmp"C:\Users\Admin\AppData\Local\Temp\8D5D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\8E95.tmp"C:\Users\Admin\AppData\Local\Temp\8E95.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\8F8F.tmp"C:\Users\Admin\AppData\Local\Temp\8F8F.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\9099.tmp"C:\Users\Admin\AppData\Local\Temp\9099.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\91A2.tmp"C:\Users\Admin\AppData\Local\Temp\91A2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\927D.tmp"C:\Users\Admin\AppData\Local\Temp\927D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\93E5.tmp"C:\Users\Admin\AppData\Local\Temp\93E5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\94EE.tmp"C:\Users\Admin\AppData\Local\Temp\94EE.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\95F8.tmp"C:\Users\Admin\AppData\Local\Temp\95F8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\97BD.tmp"C:\Users\Admin\AppData\Local\Temp\97BD.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\9888.tmp"C:\Users\Admin\AppData\Local\Temp\9888.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\99C1.tmp"C:\Users\Admin\AppData\Local\Temp\99C1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\9ADA.tmp"C:\Users\Admin\AppData\Local\Temp\9ADA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\9C03.tmp"C:\Users\Admin\AppData\Local\Temp\9C03.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\9D1C.tmp"C:\Users\Admin\AppData\Local\Temp\9D1C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\9DE7.tmp"C:\Users\Admin\AppData\Local\Temp\9DE7.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\9E74.tmp"C:\Users\Admin\AppData\Local\Temp\9E74.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\9F10.tmp"C:\Users\Admin\AppData\Local\Temp\9F10.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\9FEB.tmp"C:\Users\Admin\AppData\Local\Temp\9FEB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\A087.tmp"C:\Users\Admin\AppData\Local\Temp\A087.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\A114.tmp"C:\Users\Admin\AppData\Local\Temp\A114.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\A1DF.tmp"C:\Users\Admin\AppData\Local\Temp\A1DF.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\A25C.tmp"C:\Users\Admin\AppData\Local\Temp\A25C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\A317.tmp"C:\Users\Admin\AppData\Local\Temp\A317.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\A3D3.tmp"C:\Users\Admin\AppData\Local\Temp\A3D3.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\A4AD.tmp"C:\Users\Admin\AppData\Local\Temp\A4AD.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\A579.tmp"C:\Users\Admin\AppData\Local\Temp\A579.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\A634.tmp"C:\Users\Admin\AppData\Local\Temp\A634.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\A6FF.tmp"C:\Users\Admin\AppData\Local\Temp\A6FF.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\A79B.tmp"C:\Users\Admin\AppData\Local\Temp\A79B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\A857.tmp"C:\Users\Admin\AppData\Local\Temp\A857.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\A8F3.tmp"C:\Users\Admin\AppData\Local\Temp\A8F3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\A980.tmp"C:\Users\Admin\AppData\Local\Temp\A980.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\AA0C.tmp"C:\Users\Admin\AppData\Local\Temp\AA0C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\AA7A.tmp"C:\Users\Admin\AppData\Local\Temp\AA7A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\AAE7.tmp"C:\Users\Admin\AppData\Local\Temp\AAE7.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\AB74.tmp"C:\Users\Admin\AppData\Local\Temp\AB74.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\AC00.tmp"C:\Users\Admin\AppData\Local\Temp\AC00.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\AC8D.tmp"C:\Users\Admin\AppData\Local\Temp\AC8D.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\ADA6.tmp"C:\Users\Admin\AppData\Local\Temp\ADA6.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\AE33.tmp"C:\Users\Admin\AppData\Local\Temp\AE33.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\AECF.tmp"C:\Users\Admin\AppData\Local\Temp\AECF.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\AF6B.tmp"C:\Users\Admin\AppData\Local\Temp\AF6B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\AFE8.tmp"C:\Users\Admin\AppData\Local\Temp\AFE8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\B085.tmp"C:\Users\Admin\AppData\Local\Temp\B085.tmp"65⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\B102.tmp"C:\Users\Admin\AppData\Local\Temp\B102.tmp"66⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\B17F.tmp"C:\Users\Admin\AppData\Local\Temp\B17F.tmp"67⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\B1FC.tmp"C:\Users\Admin\AppData\Local\Temp\B1FC.tmp"68⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\B288.tmp"C:\Users\Admin\AppData\Local\Temp\B288.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\B305.tmp"C:\Users\Admin\AppData\Local\Temp\B305.tmp"70⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\B382.tmp"C:\Users\Admin\AppData\Local\Temp\B382.tmp"71⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\B3FF.tmp"C:\Users\Admin\AppData\Local\Temp\B3FF.tmp"72⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\B46D.tmp"C:\Users\Admin\AppData\Local\Temp\B46D.tmp"73⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\B4EA.tmp"C:\Users\Admin\AppData\Local\Temp\B4EA.tmp"74⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\B547.tmp"C:\Users\Admin\AppData\Local\Temp\B547.tmp"75⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\B5C4.tmp"C:\Users\Admin\AppData\Local\Temp\B5C4.tmp"76⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\B661.tmp"C:\Users\Admin\AppData\Local\Temp\B661.tmp"77⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\B6FD.tmp"C:\Users\Admin\AppData\Local\Temp\B6FD.tmp"78⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\B77A.tmp"C:\Users\Admin\AppData\Local\Temp\B77A.tmp"79⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\B7E7.tmp"C:\Users\Admin\AppData\Local\Temp\B7E7.tmp"80⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\B874.tmp"C:\Users\Admin\AppData\Local\Temp\B874.tmp"81⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\B910.tmp"C:\Users\Admin\AppData\Local\Temp\B910.tmp"82⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\B97E.tmp"C:\Users\Admin\AppData\Local\Temp\B97E.tmp"83⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\BA1A.tmp"C:\Users\Admin\AppData\Local\Temp\BA1A.tmp"84⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\BA87.tmp"C:\Users\Admin\AppData\Local\Temp\BA87.tmp"85⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\BAF5.tmp"C:\Users\Admin\AppData\Local\Temp\BAF5.tmp"86⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\BB72.tmp"C:\Users\Admin\AppData\Local\Temp\BB72.tmp"87⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"88⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\BC5C.tmp"C:\Users\Admin\AppData\Local\Temp\BC5C.tmp"89⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"90⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\BD56.tmp"C:\Users\Admin\AppData\Local\Temp\BD56.tmp"91⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"92⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\BE60.tmp"C:\Users\Admin\AppData\Local\Temp\BE60.tmp"93⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\BEDD.tmp"C:\Users\Admin\AppData\Local\Temp\BEDD.tmp"94⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\BF69.tmp"C:\Users\Admin\AppData\Local\Temp\BF69.tmp"95⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\BFE6.tmp"C:\Users\Admin\AppData\Local\Temp\BFE6.tmp"96⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\C082.tmp"C:\Users\Admin\AppData\Local\Temp\C082.tmp"97⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\C0FF.tmp"C:\Users\Admin\AppData\Local\Temp\C0FF.tmp"98⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\C17C.tmp"C:\Users\Admin\AppData\Local\Temp\C17C.tmp"99⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\C1F9.tmp"C:\Users\Admin\AppData\Local\Temp\C1F9.tmp"100⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\C286.tmp"C:\Users\Admin\AppData\Local\Temp\C286.tmp"101⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\C303.tmp"C:\Users\Admin\AppData\Local\Temp\C303.tmp"102⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\C390.tmp"C:\Users\Admin\AppData\Local\Temp\C390.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\C42C.tmp"C:\Users\Admin\AppData\Local\Temp\C42C.tmp"104⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\C4A9.tmp"C:\Users\Admin\AppData\Local\Temp\C4A9.tmp"105⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\C536.tmp"C:\Users\Admin\AppData\Local\Temp\C536.tmp"106⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\C5A3.tmp"C:\Users\Admin\AppData\Local\Temp\C5A3.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\C630.tmp"C:\Users\Admin\AppData\Local\Temp\C630.tmp"108⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\C6BC.tmp"C:\Users\Admin\AppData\Local\Temp\C6BC.tmp"109⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\C72A.tmp"C:\Users\Admin\AppData\Local\Temp\C72A.tmp"110⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\C7A7.tmp"C:\Users\Admin\AppData\Local\Temp\C7A7.tmp"111⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\C843.tmp"C:\Users\Admin\AppData\Local\Temp\C843.tmp"112⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\C8DF.tmp"C:\Users\Admin\AppData\Local\Temp\C8DF.tmp"113⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\C95C.tmp"C:\Users\Admin\AppData\Local\Temp\C95C.tmp"114⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\C9BA.tmp"C:\Users\Admin\AppData\Local\Temp\C9BA.tmp"115⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\CA56.tmp"C:\Users\Admin\AppData\Local\Temp\CA56.tmp"116⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\CAE3.tmp"C:\Users\Admin\AppData\Local\Temp\CAE3.tmp"117⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\CB60.tmp"C:\Users\Admin\AppData\Local\Temp\CB60.tmp"118⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\CBDD.tmp"C:\Users\Admin\AppData\Local\Temp\CBDD.tmp"119⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\CC5A.tmp"C:\Users\Admin\AppData\Local\Temp\CC5A.tmp"120⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\CCE6.tmp"C:\Users\Admin\AppData\Local\Temp\CCE6.tmp"121⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\CD73.tmp"C:\Users\Admin\AppData\Local\Temp\CD73.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:4736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-