Analysis
- max time kernel
115s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_9e7987474bb9891477489289064ed16b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_9e7987474bb9891477489289064ed16b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-28_9e7987474bb9891477489289064ed16b_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260728-2cdt2ay1f1
- SHA256 e48403efc50f5e3eeeb6ab9a3ead48088f9959c20882cea3b38b6adf57b8ed96
- MD5 9e7987474bb9891477489289064ed16b
- SHA1 d3ab48e0755ab1432221dbb095fe1ee5e947ed6d
- SHA512 89fe5ba532db9af593e748c2ee4d68d53744f4e076d66a8e61fd3c5a70d4977d19814b499bb01279e98279a6c6d2c64f2c1667912a87c74d20b87a6ec19f85b1
- SSDEEP 12288:wU5rCOTeiDv1V6X84rN7vJbpMoJNcHf4JmNZ+3/v+I9hUG2VA:wUQOJDv1V6X84rN7go3cHfomNGEA
- TLSH T18CE4D12177D8C132E9F7037859B5E6644E7DBD226722D6CF2F8016AE09B1BC09A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2328 867C.tmp 2384 8766.tmp 1816 890C.tmp 264 8999.tmp 5496 8AD1.tmp 980 8C39.tmp 4412 8CE4.tmp 3460 8DFE.tmp 5352 8EE8.tmp 244 905F.tmp 2468 91A7.tmp 628 92A1.tmp 460 93BA.tmp 2140 9503.tmp 2264 963B.tmp 4788 9735.tmp 5328 987D.tmp 2688 9996.tmp 756 9A81.tmp 3304 9BE8.tmp 4592 9CF2.tmp 5024 9E2A.tmp 2576 9F53.tmp 4368 A06C.tmp 4932 A186.tmp 2128 A28F.tmp 1952 A389.tmp 4312 A474.tmp 4444 A5CB.tmp 3204 A6D5.tmp 6080 A7DF.tmp 3756 A936.tmp 3436 AA40.tmp 3944 AB2A.tmp 6028 AC53.tmp 1896 AD6D.tmp 1412 AE47.tmp 3036 AF41.tmp 2852 B03B.tmp 4992 B0F7.tmp 3492 B22F.tmp 4784 B2FA.tmp 1060 B3F4.tmp 1472 B4DF.tmp 1428 B5C9.tmp 2968 B6A4.tmp 4192 B78E.tmp 5624 B8A8.tmp 1052 B953.tmp 548 BA0F.tmp 1724 BA9C.tmp 1860 BB67.tmp 2736 BC13.tmp 4320 BCBE.tmp 4676 BD4B.tmp 3408 BDD8.tmp 5996 BE93.tmp 4256 BF4F.tmp 1372 C01A.tmp 2296 C0F5.tmp 4696 C191.tmp 2292 C24C.tmp 2976 C2C9.tmp 2356 C356.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 701.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 890C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A20E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A389.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C499.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 275F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 834B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 399F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D67B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F82C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 421B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 442E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E88C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C516.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 129F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B78E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 477A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1512 wrote to memory of 2328 1512 2026-07-28_9e7987474bb9891477489289064ed16b_elex_mafia_stealc_tofsee.exe 90 PID 2328 wrote to memory of 2384 2328 867C.tmp 91 PID 2384 wrote to memory of 1816 2384 8766.tmp 92 PID 1816 wrote to memory of 264 1816 890C.tmp 93 PID 264 wrote to memory of 5496 264 8999.tmp 94 PID 5496 wrote to memory of 980 5496 8AD1.tmp 95 PID 980 wrote to memory of 4412 980 8C39.tmp 96 PID 4412 wrote to memory of 3460 4412 8CE4.tmp 97 PID 3460 wrote to memory of 5352 3460 8DFE.tmp 98 PID 5352 wrote to memory of 244 5352 8EE8.tmp 99 PID 244 wrote to memory of 2468 244 905F.tmp 100 PID 2468 wrote to memory of 628 2468 91A7.tmp 101 PID 628 wrote to memory of 460 628 92A1.tmp 102 PID 460 wrote to memory of 2140 460 93BA.tmp 103 PID 2140 wrote to memory of 2264 2140 9503.tmp 104 PID 2264 wrote to memory of 4788 2264 963B.tmp 105 PID 4788 wrote to memory of 5328 4788 9735.tmp 106 PID 5328 wrote to memory of 2688 5328 987D.tmp 107 PID 2688 wrote to memory of 756 2688 9996.tmp 108 PID 756 wrote to memory of 3304 756 9A81.tmp 109 PID 3304 wrote to memory of 4592 3304 9BE8.tmp 110 PID 4592 wrote to memory of 5024 4592 9CF2.tmp 111 PID 5024 wrote to memory of 2576 5024 9E2A.tmp 112 PID 2576 wrote to memory of 4368 2576 9F53.tmp 113 PID 4368 wrote to memory of 4932 4368 A06C.tmp 114 PID 4932 wrote to memory of 2128 4932 A186.tmp 115 PID 2128 wrote to memory of 1952 2128 A28F.tmp 116 PID 1952 wrote to memory of 4312 1952 A389.tmp 117 PID 4312 wrote to memory of 4444 4312 A474.tmp 118 PID 4444 wrote to memory of 3204 4444 A5CB.tmp 119 PID 3204 wrote to memory of 6080 3204 A6D5.tmp 120 PID 6080 wrote to memory of 3756 6080 A7DF.tmp 121 PID 3756 wrote to memory of 3436 3756 A936.tmp 122 PID 3436 wrote to memory of 3944 3436 AA40.tmp 123 PID 3944 wrote to memory of 6028 3944 AB2A.tmp 124 PID 6028 wrote to memory of 1896 6028 AC53.tmp 125 PID 1896 wrote to memory of 1412 1896 AD6D.tmp 126 PID 1412 wrote to memory of 3036 1412 AE47.tmp 127 PID 3036 wrote to memory of 2852 3036 AF41.tmp 128 PID 2852 wrote to memory of 4992 2852 B03B.tmp 129 PID 4992 wrote to memory of 3492 4992 B0F7.tmp 130 PID 3492 wrote to memory of 4784 3492 B22F.tmp 131 PID 4784 wrote to memory of 1060 4784 B2FA.tmp 132 PID 1060 wrote to memory of 1472 1060 B3F4.tmp 133 PID 1472 wrote to memory of 1428 1472 B4DF.tmp 134 PID 1428 wrote to memory of 2968 1428 B5C9.tmp 135 PID 2968 wrote to memory of 4192 2968 B6A4.tmp 136 PID 4192 wrote to memory of 5624 4192 B78E.tmp 137 PID 5624 wrote to memory of 1052 5624 B8A8.tmp 138 PID 1052 wrote to memory of 548 1052 B953.tmp 139 PID 548 wrote to memory of 1724 548 BA0F.tmp 140 PID 1724 wrote to memory of 1860 1724 BA9C.tmp 141 PID 1860 wrote to memory of 2736 1860 BB67.tmp 142 PID 2736 wrote to memory of 4320 2736 BC13.tmp 143 PID 4320 wrote to memory of 4676 4320 BCBE.tmp 144 PID 4676 wrote to memory of 3408 4676 BD4B.tmp 145 PID 3408 wrote to memory of 5996 3408 BDD8.tmp 146 PID 5996 wrote to memory of 4256 5996 BE93.tmp 147 PID 4256 wrote to memory of 1372 4256 BF4F.tmp 148 PID 1372 wrote to memory of 2296 1372 C01A.tmp 149 PID 2296 wrote to memory of 4696 2296 C0F5.tmp 150 PID 4696 wrote to memory of 2292 4696 C191.tmp 151 PID 2292 wrote to memory of 2976 2292 C24C.tmp 152 PID 2976 wrote to memory of 2356 2976 C2C9.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_9e7987474bb9891477489289064ed16b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_9e7987474bb9891477489289064ed16b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\867C.tmp"C:\Users\Admin\AppData\Local\Temp\867C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\8766.tmp"C:\Users\Admin\AppData\Local\Temp\8766.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\890C.tmp"C:\Users\Admin\AppData\Local\Temp\890C.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\8999.tmp"C:\Users\Admin\AppData\Local\Temp\8999.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\905F.tmp"C:\Users\Admin\AppData\Local\Temp\905F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\91A7.tmp"C:\Users\Admin\AppData\Local\Temp\91A7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\92A1.tmp"C:\Users\Admin\AppData\Local\Temp\92A1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\93BA.tmp"C:\Users\Admin\AppData\Local\Temp\93BA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\9503.tmp"C:\Users\Admin\AppData\Local\Temp\9503.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\963B.tmp"C:\Users\Admin\AppData\Local\Temp\963B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\9735.tmp"C:\Users\Admin\AppData\Local\Temp\9735.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\987D.tmp"C:\Users\Admin\AppData\Local\Temp\987D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\9996.tmp"C:\Users\Admin\AppData\Local\Temp\9996.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\9A81.tmp"C:\Users\Admin\AppData\Local\Temp\9A81.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\9E2A.tmp"C:\Users\Admin\AppData\Local\Temp\9E2A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\9F53.tmp"C:\Users\Admin\AppData\Local\Temp\9F53.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\A06C.tmp"C:\Users\Admin\AppData\Local\Temp\A06C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\A186.tmp"C:\Users\Admin\AppData\Local\Temp\A186.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\A28F.tmp"C:\Users\Admin\AppData\Local\Temp\A28F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\A389.tmp"C:\Users\Admin\AppData\Local\Temp\A389.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\A474.tmp"C:\Users\Admin\AppData\Local\Temp\A474.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\A5CB.tmp"C:\Users\Admin\AppData\Local\Temp\A5CB.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\A936.tmp"C:\Users\Admin\AppData\Local\Temp\A936.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\AA40.tmp"C:\Users\Admin\AppData\Local\Temp\AA40.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\AB2A.tmp"C:\Users\Admin\AppData\Local\Temp\AB2A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\AC53.tmp"C:\Users\Admin\AppData\Local\Temp\AC53.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\AE47.tmp"C:\Users\Admin\AppData\Local\Temp\AE47.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\AF41.tmp"C:\Users\Admin\AppData\Local\Temp\AF41.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\B03B.tmp"C:\Users\Admin\AppData\Local\Temp\B03B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\B78E.tmp"C:\Users\Admin\AppData\Local\Temp\B78E.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\BB67.tmp"C:\Users\Admin\AppData\Local\Temp\BB67.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\BC13.tmp"C:\Users\Admin\AppData\Local\Temp\BC13.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\BCBE.tmp"C:\Users\Admin\AppData\Local\Temp\BCBE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\BD4B.tmp"C:\Users\Admin\AppData\Local\Temp\BD4B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\BDD8.tmp"C:\Users\Admin\AppData\Local\Temp\BDD8.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\BE93.tmp"C:\Users\Admin\AppData\Local\Temp\BE93.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\C01A.tmp"C:\Users\Admin\AppData\Local\Temp\C01A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\C191.tmp"C:\Users\Admin\AppData\Local\Temp\C191.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\C356.tmp"C:\Users\Admin\AppData\Local\Temp\C356.tmp"65⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\C402.tmp"C:\Users\Admin\AppData\Local\Temp\C402.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\C49E.tmp"C:\Users\Admin\AppData\Local\Temp\C49E.tmp"67⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\C54A.tmp"C:\Users\Admin\AppData\Local\Temp\C54A.tmp"68⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\C615.tmp"C:\Users\Admin\AppData\Local\Temp\C615.tmp"69⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"70⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\C74E.tmp"C:\Users\Admin\AppData\Local\Temp\C74E.tmp"71⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\C7CB.tmp"C:\Users\Admin\AppData\Local\Temp\C7CB.tmp"72⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\C848.tmp"C:\Users\Admin\AppData\Local\Temp\C848.tmp"73⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"74⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"75⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\CA7A.tmp"C:\Users\Admin\AppData\Local\Temp\CA7A.tmp"76⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"77⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"78⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"79⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"80⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\CD97.tmp"C:\Users\Admin\AppData\Local\Temp\CD97.tmp"81⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\CE24.tmp"C:\Users\Admin\AppData\Local\Temp\CE24.tmp"82⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"83⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"84⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:468 -
C:\Users\Admin\AppData\Local\Temp\D085.tmp"C:\Users\Admin\AppData\Local\Temp\D085.tmp"86⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\D121.tmp"C:\Users\Admin\AppData\Local\Temp\D121.tmp"87⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"88⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\D298.tmp"C:\Users\Admin\AppData\Local\Temp\D298.tmp"89⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\D334.tmp"C:\Users\Admin\AppData\Local\Temp\D334.tmp"90⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"91⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\D47D.tmp"C:\Users\Admin\AppData\Local\Temp\D47D.tmp"92⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\D519.tmp"C:\Users\Admin\AppData\Local\Temp\D519.tmp"93⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\D5D4.tmp"C:\Users\Admin\AppData\Local\Temp\D5D4.tmp"94⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\D671.tmp"C:\Users\Admin\AppData\Local\Temp\D671.tmp"95⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"96⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"97⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"98⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"99⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\D95F.tmp"C:\Users\Admin\AppData\Local\Temp\D95F.tmp"100⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"101⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"102⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\DB53.tmp"C:\Users\Admin\AppData\Local\Temp\DB53.tmp"103⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\DC5C.tmp"C:\Users\Admin\AppData\Local\Temp\DC5C.tmp"104⤵PID:96
-
C:\Users\Admin\AppData\Local\Temp\DCE9.tmp"C:\Users\Admin\AppData\Local\Temp\DCE9.tmp"105⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\DD85.tmp"C:\Users\Admin\AppData\Local\Temp\DD85.tmp"106⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\DE31.tmp"C:\Users\Admin\AppData\Local\Temp\DE31.tmp"107⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\DECD.tmp"C:\Users\Admin\AppData\Local\Temp\DECD.tmp"108⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"109⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"110⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\E083.tmp"C:\Users\Admin\AppData\Local\Temp\E083.tmp"111⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\E14E.tmp"C:\Users\Admin\AppData\Local\Temp\E14E.tmp"112⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"113⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"114⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\E332.tmp"C:\Users\Admin\AppData\Local\Temp\E332.tmp"115⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"116⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\E42C.tmp"C:\Users\Admin\AppData\Local\Temp\E42C.tmp"117⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"118⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"119⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"120⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"121⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\E778.tmp"C:\Users\Admin\AppData\Local\Temp\E778.tmp"122⤵PID:5880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-