Analysis
- max time kernel
130s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 03:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_b868b9e852fa7282cf0163e138a79ac5_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_b868b9e852fa7282cf0163e138a79ac5_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260617-en
3 signatures
150 seconds
General
- Target 2026-06-27_b868b9e852fa7282cf0163e138a79ac5_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260629-d4b8hsdv3q
- SHA256 65509a2b11b1dfe995465975b221e6b5ce65d9e44e4bb3637e7cda673b0935dc
- MD5 b868b9e852fa7282cf0163e138a79ac5
- SHA1 b53f244d4d6139db2e72a653de3f67e0e5493277
- SHA512 c98b6cd7295072f32d87a73a29bc1264547c4cc9912ac55bdfe5ccb8fe694ad538eaf422eca89ca91c97eb87481323a814e8f8acc649fef90095d4a04f1f7f7d
- SSDEEP 6144:oorf3lPvovsgZnqG2C7mOTeiL/DLy/SyLwQRIeCNdH63YW7IHIJa7scr+f+FoIj3:NU5rCOTeijC6EHIeeO7IWcrwuQTZwlH
- TLSH T1D3B4E026B185C033E6D202720EE6E7A25A3B7D705726A4C73B94672E2F712E1D77530B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4784 B84F.tmp 4428 B90A.tmp 4508 B9B6.tmp 4532 BA71.tmp 2684 BB2D.tmp 5988 BBC9.tmp 4280 BC65.tmp 5952 BD11.tmp 2480 BD9E.tmp 5748 BE79.tmp 3352 BEF6.tmp 2840 BFF0.tmp 2528 C0BB.tmp 5580 C186.tmp 5376 C232.tmp 4272 C2FD.tmp 3836 C399.tmp 2696 C455.tmp 5496 C510.tmp 4184 C59D.tmp 3544 C629.tmp 4676 C6B6.tmp 8 C7A0.tmp 468 C83D.tmp 6024 C8BA.tmp 408 C994.tmp 240 CA11.tmp 5264 CABD.tmp 2952 CB4A.tmp 3144 CBF6.tmp 3096 CC92.tmp 2096 CD5D.tmp 3784 CE09.tmp 2636 CE86.tmp 1616 CF32.tmp 3316 CFCE.tmp 760 D04B.tmp 2000 D0B9.tmp 4212 D126.tmp 2796 D1B3.tmp 2688 D23F.tmp 3540 D2CC.tmp 2188 D358.tmp 4860 D3D5.tmp 4324 D443.tmp 4792 D4C0.tmp 3816 D54C.tmp 3044 D5F8.tmp 6000 D685.tmp 3288 D712.tmp 5728 D77F.tmp 2136 D80C.tmp 5624 D889.tmp 5852 D906.tmp 2232 D992.tmp 3004 DA0F.tmp 4064 DA8C.tmp 3680 DB38.tmp 1200 DBB5.tmp 5536 DC32.tmp 2456 DCCE.tmp 3468 DD3C.tmp 4848 DDB9.tmp 1916 DE26.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E059.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 291A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 575.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 261C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 895A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 832B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 906F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F78A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 163D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C172.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 550C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 548A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD1A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5904 wrote to memory of 4784 5904 2026-06-27_b868b9e852fa7282cf0163e138a79ac5_elex_mafia_stealc_tofsee.exe 89 PID 4784 wrote to memory of 4428 4784 B84F.tmp 90 PID 4428 wrote to memory of 4508 4428 B90A.tmp 91 PID 4508 wrote to memory of 4532 4508 B9B6.tmp 92 PID 4532 wrote to memory of 2684 4532 BA71.tmp 93 PID 2684 wrote to memory of 5988 2684 BB2D.tmp 94 PID 5988 wrote to memory of 4280 5988 BBC9.tmp 95 PID 4280 wrote to memory of 5952 4280 BC65.tmp 96 PID 5952 wrote to memory of 2480 5952 BD11.tmp 97 PID 2480 wrote to memory of 5748 2480 BD9E.tmp 98 PID 5748 wrote to memory of 3352 5748 BE79.tmp 99 PID 3352 wrote to memory of 2840 3352 BEF6.tmp 100 PID 2840 wrote to memory of 2528 2840 BFF0.tmp 101 PID 2528 wrote to memory of 5580 2528 C0BB.tmp 102 PID 5580 wrote to memory of 5376 5580 C186.tmp 103 PID 5376 wrote to memory of 4272 5376 C232.tmp 104 PID 4272 wrote to memory of 3836 4272 C2FD.tmp 105 PID 3836 wrote to memory of 2696 3836 C399.tmp 106 PID 2696 wrote to memory of 5496 2696 C455.tmp 107 PID 5496 wrote to memory of 4184 5496 C510.tmp 108 PID 4184 wrote to memory of 3544 4184 C59D.tmp 109 PID 3544 wrote to memory of 4676 3544 C629.tmp 110 PID 4676 wrote to memory of 8 4676 C6B6.tmp 111 PID 8 wrote to memory of 468 8 C7A0.tmp 112 PID 468 wrote to memory of 6024 468 C83D.tmp 113 PID 6024 wrote to memory of 408 6024 C8BA.tmp 114 PID 408 wrote to memory of 240 408 C994.tmp 115 PID 240 wrote to memory of 5264 240 CA11.tmp 116 PID 5264 wrote to memory of 2952 5264 CABD.tmp 117 PID 2952 wrote to memory of 3144 2952 CB4A.tmp 118 PID 3144 wrote to memory of 3096 3144 CBF6.tmp 119 PID 3096 wrote to memory of 2096 3096 CC92.tmp 120 PID 2096 wrote to memory of 3784 2096 CD5D.tmp 121 PID 3784 wrote to memory of 2636 3784 CE09.tmp 122 PID 2636 wrote to memory of 1616 2636 CE86.tmp 123 PID 1616 wrote to memory of 3316 1616 CF32.tmp 124 PID 3316 wrote to memory of 760 3316 CFCE.tmp 125 PID 760 wrote to memory of 2000 760 D04B.tmp 126 PID 2000 wrote to memory of 4212 2000 D0B9.tmp 127 PID 4212 wrote to memory of 2796 4212 D126.tmp 128 PID 2796 wrote to memory of 2688 2796 D1B3.tmp 129 PID 2688 wrote to memory of 3540 2688 D23F.tmp 130 PID 3540 wrote to memory of 2188 3540 D2CC.tmp 131 PID 2188 wrote to memory of 4860 2188 D358.tmp 132 PID 4860 wrote to memory of 4324 4860 D3D5.tmp 133 PID 4324 wrote to memory of 4792 4324 D443.tmp 134 PID 4792 wrote to memory of 3816 4792 D4C0.tmp 135 PID 3816 wrote to memory of 3044 3816 D54C.tmp 136 PID 3044 wrote to memory of 6000 3044 D5F8.tmp 137 PID 6000 wrote to memory of 3288 6000 D685.tmp 138 PID 3288 wrote to memory of 5728 3288 D712.tmp 139 PID 5728 wrote to memory of 2136 5728 D77F.tmp 140 PID 2136 wrote to memory of 5624 2136 D80C.tmp 141 PID 5624 wrote to memory of 5852 5624 D889.tmp 142 PID 5852 wrote to memory of 2232 5852 D906.tmp 143 PID 2232 wrote to memory of 3004 2232 D992.tmp 144 PID 3004 wrote to memory of 4064 3004 DA0F.tmp 145 PID 4064 wrote to memory of 3680 4064 DA8C.tmp 146 PID 3680 wrote to memory of 1200 3680 DB38.tmp 147 PID 1200 wrote to memory of 5536 1200 DBB5.tmp 148 PID 5536 wrote to memory of 2456 5536 DC32.tmp 149 PID 2456 wrote to memory of 3468 2456 DCCE.tmp 150 PID 3468 wrote to memory of 4848 3468 DD3C.tmp 151 PID 4848 wrote to memory of 1916 4848 DDB9.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_b868b9e852fa7282cf0163e138a79ac5_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_b868b9e852fa7282cf0163e138a79ac5_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\B84F.tmp"C:\Users\Admin\AppData\Local\Temp\B84F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\B90A.tmp"C:\Users\Admin\AppData\Local\Temp\B90A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\BA71.tmp"C:\Users\Admin\AppData\Local\Temp\BA71.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\BC65.tmp"C:\Users\Admin\AppData\Local\Temp\BC65.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\BD11.tmp"C:\Users\Admin\AppData\Local\Temp\BD11.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\BD9E.tmp"C:\Users\Admin\AppData\Local\Temp\BD9E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\BE79.tmp"C:\Users\Admin\AppData\Local\Temp\BE79.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\BFF0.tmp"C:\Users\Admin\AppData\Local\Temp\BFF0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\C186.tmp"C:\Users\Admin\AppData\Local\Temp\C186.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\C232.tmp"C:\Users\Admin\AppData\Local\Temp\C232.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\C399.tmp"C:\Users\Admin\AppData\Local\Temp\C399.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\C455.tmp"C:\Users\Admin\AppData\Local\Temp\C455.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\C510.tmp"C:\Users\Admin\AppData\Local\Temp\C510.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\C59D.tmp"C:\Users\Admin\AppData\Local\Temp\C59D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\C629.tmp"C:\Users\Admin\AppData\Local\Temp\C629.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\C7A0.tmp"C:\Users\Admin\AppData\Local\Temp\C7A0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\C83D.tmp"C:\Users\Admin\AppData\Local\Temp\C83D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\C994.tmp"C:\Users\Admin\AppData\Local\Temp\C994.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\CA11.tmp"C:\Users\Admin\AppData\Local\Temp\CA11.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\CABD.tmp"C:\Users\Admin\AppData\Local\Temp\CABD.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\CE86.tmp"C:\Users\Admin\AppData\Local\Temp\CE86.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\CF32.tmp"C:\Users\Admin\AppData\Local\Temp\CF32.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\D04B.tmp"C:\Users\Admin\AppData\Local\Temp\D04B.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\D126.tmp"C:\Users\Admin\AppData\Local\Temp\D126.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\D23F.tmp"C:\Users\Admin\AppData\Local\Temp\D23F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\D358.tmp"C:\Users\Admin\AppData\Local\Temp\D358.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\D443.tmp"C:\Users\Admin\AppData\Local\Temp\D443.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\D54C.tmp"C:\Users\Admin\AppData\Local\Temp\D54C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\D5F8.tmp"C:\Users\Admin\AppData\Local\Temp\D5F8.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\D685.tmp"C:\Users\Admin\AppData\Local\Temp\D685.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\D77F.tmp"C:\Users\Admin\AppData\Local\Temp\D77F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\D80C.tmp"C:\Users\Admin\AppData\Local\Temp\D80C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\D906.tmp"C:\Users\Admin\AppData\Local\Temp\D906.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\D992.tmp"C:\Users\Admin\AppData\Local\Temp\D992.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\DA0F.tmp"C:\Users\Admin\AppData\Local\Temp\DA0F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\DB38.tmp"C:\Users\Admin\AppData\Local\Temp\DB38.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\DC32.tmp"C:\Users\Admin\AppData\Local\Temp\DC32.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\DD3C.tmp"C:\Users\Admin\AppData\Local\Temp\DD3C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\DE26.tmp"C:\Users\Admin\AppData\Local\Temp\DE26.tmp"65⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\DEB3.tmp"C:\Users\Admin\AppData\Local\Temp\DEB3.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\DF30.tmp"C:\Users\Admin\AppData\Local\Temp\DF30.tmp"67⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"68⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\E059.tmp"C:\Users\Admin\AppData\Local\Temp\E059.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"70⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\E153.tmp"C:\Users\Admin\AppData\Local\Temp\E153.tmp"71⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\E1DF.tmp"C:\Users\Admin\AppData\Local\Temp\E1DF.tmp"72⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\E25C.tmp"C:\Users\Admin\AppData\Local\Temp\E25C.tmp"73⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"74⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"75⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\E421.tmp"C:\Users\Admin\AppData\Local\Temp\E421.tmp"76⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"77⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\E54A.tmp"C:\Users\Admin\AppData\Local\Temp\E54A.tmp"78⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"79⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\E683.tmp"C:\Users\Admin\AppData\Local\Temp\E683.tmp"80⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\E700.tmp"C:\Users\Admin\AppData\Local\Temp\E700.tmp"81⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\E79C.tmp"C:\Users\Admin\AppData\Local\Temp\E79C.tmp"82⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\E819.tmp"C:\Users\Admin\AppData\Local\Temp\E819.tmp"83⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\E896.tmp"C:\Users\Admin\AppData\Local\Temp\E896.tmp"84⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\E913.tmp"C:\Users\Admin\AppData\Local\Temp\E913.tmp"85⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"86⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"87⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\EA8A.tmp"C:\Users\Admin\AppData\Local\Temp\EA8A.tmp"88⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\EB17.tmp"C:\Users\Admin\AppData\Local\Temp\EB17.tmp"89⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\EB94.tmp"C:\Users\Admin\AppData\Local\Temp\EB94.tmp"90⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\EC20.tmp"C:\Users\Admin\AppData\Local\Temp\EC20.tmp"91⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"92⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\ED49.tmp"C:\Users\Admin\AppData\Local\Temp\ED49.tmp"93⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\EE43.tmp"C:\Users\Admin\AppData\Local\Temp\EE43.tmp"95⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\EEB0.tmp"C:\Users\Admin\AppData\Local\Temp\EEB0.tmp"96⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\EF3D.tmp"C:\Users\Admin\AppData\Local\Temp\EF3D.tmp"97⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\EFAA.tmp"C:\Users\Admin\AppData\Local\Temp\EFAA.tmp"98⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\F037.tmp"C:\Users\Admin\AppData\Local\Temp\F037.tmp"99⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"100⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\F121.tmp"C:\Users\Admin\AppData\Local\Temp\F121.tmp"101⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\F18F.tmp"C:\Users\Admin\AppData\Local\Temp\F18F.tmp"102⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\F21B.tmp"C:\Users\Admin\AppData\Local\Temp\F21B.tmp"103⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\F298.tmp"C:\Users\Admin\AppData\Local\Temp\F298.tmp"104⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"105⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"106⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\F43E.tmp"C:\Users\Admin\AppData\Local\Temp\F43E.tmp"107⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"108⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\F586.tmp"C:\Users\Admin\AppData\Local\Temp\F586.tmp"109⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\F603.tmp"C:\Users\Admin\AppData\Local\Temp\F603.tmp"110⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\F680.tmp"C:\Users\Admin\AppData\Local\Temp\F680.tmp"111⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\F6FD.tmp"C:\Users\Admin\AppData\Local\Temp\F6FD.tmp"112⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\F78A.tmp"C:\Users\Admin\AppData\Local\Temp\F78A.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\F7F7.tmp"C:\Users\Admin\AppData\Local\Temp\F7F7.tmp"114⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\F865.tmp"C:\Users\Admin\AppData\Local\Temp\F865.tmp"115⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\F8F1.tmp"C:\Users\Admin\AppData\Local\Temp\F8F1.tmp"116⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\F97E.tmp"C:\Users\Admin\AppData\Local\Temp\F97E.tmp"117⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"118⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\FA78.tmp"C:\Users\Admin\AppData\Local\Temp\FA78.tmp"119⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"120⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\FB72.tmp"C:\Users\Admin\AppData\Local\Temp\FB72.tmp"121⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\FBDF.tmp"C:\Users\Admin\AppData\Local\Temp\FBDF.tmp"122⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-