Analysis
- max time kernel
109s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_8d5c96de21f638cbd4db9fb891845e4e_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_8d5c96de21f638cbd4db9fb891845e4e_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-28_8d5c96de21f638cbd4db9fb891845e4e_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260728-2g6evacc39
- SHA256 5173cd283971aaa90d7e0ae066708c1ac727a9e3fa8bdd5a292a10b865af47c5
- MD5 8d5c96de21f638cbd4db9fb891845e4e
- SHA1 e0762bfcd5fe2357ee41655d5703efaf1d4c8c0f
- SHA512 54fbd72cf9ca68cccfd71109656fad47524c78c078fa6382946c521381f082306c91ec5bca7d621c669e3b3779abc60f8814c5893dd3bf24469da41e3e8a61dd
- SSDEEP 12288:NU5rCOTeijsqFsM6h6JCuf+xGL9oLjTZwlH:NUQOJjs7gwDUoLjTSlH
- TLSH T109B4F125B645C432E68202710BD6EBB2293BBD315726A4C73BD4677E2FB17E19378306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4640 82A3.tmp 3004 836F.tmp 3472 8469.tmp 4196 8505.tmp 4484 85E0.tmp 3308 864D.tmp 3252 8747.tmp 2704 8831.tmp 4932 89C8.tmp 3180 8A83.tmp 3392 8B2F.tmp 4228 8BCB.tmp 2368 8C58.tmp 2476 8D04.tmp 572 8DCF.tmp 3988 8E7B.tmp 5472 8F27.tmp 3420 8FC3.tmp 2548 909E.tmp 3796 9159.tmp 2744 91C6.tmp 3916 9263.tmp 3636 932E.tmp 2984 93CA.tmp 5940 9466.tmp 5520 9522.tmp 3668 960C.tmp 2232 9735.tmp 2988 97C2.tmp 1484 987D.tmp 2628 9958.tmp 2836 99E5.tmp 1852 9AB0.tmp 3980 9B1D.tmp 2800 9BAA.tmp 3892 9C36.tmp 1792 9CB3.tmp 3524 9D21.tmp 5260 9DCD.tmp 5148 9E4A.tmp 4700 9ED6.tmp 3452 9F72.tmp 2216 A02E.tmp 4296 A0AB.tmp 3760 A118.tmp 5496 A195.tmp 5924 A232.tmp 1392 A29F.tmp 4200 A33B.tmp 716 A3C8.tmp 5392 A426.tmp 5864 A4C2.tmp 5980 A56E.tmp 3612 A5DB.tmp 260 A668.tmp 3076 A6F4.tmp 5248 A781.tmp 1748 A7EE.tmp 4744 A86B.tmp 4128 A8F8.tmp 5380 A9A4.tmp 4388 AA21.tmp 5728 AABD.tmp 5616 AB2A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 329A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C034.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 859.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 228D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 972.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5545.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2702.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 761C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9442.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C881.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 125.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8E4.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3556 wrote to memory of 4640 3556 2026-07-28_8d5c96de21f638cbd4db9fb891845e4e_elex_mafia_stealc_tofsee.exe 90 PID 4640 wrote to memory of 3004 4640 82A3.tmp 91 PID 3004 wrote to memory of 3472 3004 836F.tmp 92 PID 3472 wrote to memory of 4196 3472 8469.tmp 93 PID 4196 wrote to memory of 4484 4196 8505.tmp 94 PID 4484 wrote to memory of 3308 4484 85E0.tmp 95 PID 3308 wrote to memory of 3252 3308 864D.tmp 96 PID 3252 wrote to memory of 2704 3252 8747.tmp 97 PID 2704 wrote to memory of 4932 2704 8831.tmp 98 PID 4932 wrote to memory of 3180 4932 89C8.tmp 99 PID 3180 wrote to memory of 3392 3180 8A83.tmp 100 PID 3392 wrote to memory of 4228 3392 8B2F.tmp 101 PID 4228 wrote to memory of 2368 4228 8BCB.tmp 102 PID 2368 wrote to memory of 2476 2368 8C58.tmp 103 PID 2476 wrote to memory of 572 2476 8D04.tmp 104 PID 572 wrote to memory of 3988 572 8DCF.tmp 105 PID 3988 wrote to memory of 5472 3988 8E7B.tmp 106 PID 5472 wrote to memory of 3420 5472 8F27.tmp 107 PID 3420 wrote to memory of 2548 3420 8FC3.tmp 108 PID 2548 wrote to memory of 3796 2548 909E.tmp 109 PID 3796 wrote to memory of 2744 3796 9159.tmp 110 PID 2744 wrote to memory of 3916 2744 91C6.tmp 111 PID 3916 wrote to memory of 3636 3916 9263.tmp 112 PID 3636 wrote to memory of 2984 3636 932E.tmp 113 PID 2984 wrote to memory of 5940 2984 93CA.tmp 114 PID 5940 wrote to memory of 5520 5940 9466.tmp 115 PID 5520 wrote to memory of 3668 5520 9522.tmp 116 PID 3668 wrote to memory of 2232 3668 960C.tmp 117 PID 2232 wrote to memory of 2988 2232 9735.tmp 118 PID 2988 wrote to memory of 1484 2988 97C2.tmp 119 PID 1484 wrote to memory of 2628 1484 987D.tmp 120 PID 2628 wrote to memory of 2836 2628 9958.tmp 121 PID 2836 wrote to memory of 1852 2836 99E5.tmp 122 PID 1852 wrote to memory of 3980 1852 9AB0.tmp 123 PID 3980 wrote to memory of 2800 3980 9B1D.tmp 124 PID 2800 wrote to memory of 3892 2800 9BAA.tmp 125 PID 3892 wrote to memory of 1792 3892 9C36.tmp 126 PID 1792 wrote to memory of 3524 1792 9CB3.tmp 127 PID 3524 wrote to memory of 5260 3524 9D21.tmp 128 PID 5260 wrote to memory of 5148 5260 9DCD.tmp 129 PID 5148 wrote to memory of 4700 5148 9E4A.tmp 130 PID 4700 wrote to memory of 3452 4700 9ED6.tmp 131 PID 3452 wrote to memory of 2216 3452 9F72.tmp 132 PID 2216 wrote to memory of 4296 2216 A02E.tmp 133 PID 4296 wrote to memory of 3760 4296 A0AB.tmp 134 PID 3760 wrote to memory of 5496 3760 A118.tmp 135 PID 5496 wrote to memory of 5924 5496 A195.tmp 136 PID 5924 wrote to memory of 1392 5924 A232.tmp 137 PID 1392 wrote to memory of 4200 1392 A29F.tmp 138 PID 4200 wrote to memory of 716 4200 A33B.tmp 139 PID 716 wrote to memory of 5392 716 A3C8.tmp 140 PID 5392 wrote to memory of 5864 5392 A426.tmp 141 PID 5864 wrote to memory of 5980 5864 A4C2.tmp 142 PID 5980 wrote to memory of 3612 5980 A56E.tmp 143 PID 3612 wrote to memory of 260 3612 A5DB.tmp 144 PID 260 wrote to memory of 3076 260 A668.tmp 145 PID 3076 wrote to memory of 5248 3076 A6F4.tmp 146 PID 5248 wrote to memory of 1748 5248 A781.tmp 147 PID 1748 wrote to memory of 4744 1748 A7EE.tmp 148 PID 4744 wrote to memory of 4128 4744 A86B.tmp 149 PID 4128 wrote to memory of 5380 4128 A8F8.tmp 150 PID 5380 wrote to memory of 4388 5380 A9A4.tmp 151 PID 4388 wrote to memory of 5728 4388 AA21.tmp 152 PID 5728 wrote to memory of 5616 5728 AABD.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d5c96de21f638cbd4db9fb891845e4e_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_8d5c96de21f638cbd4db9fb891845e4e_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\82A3.tmp"C:\Users\Admin\AppData\Local\Temp\82A3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\836F.tmp"C:\Users\Admin\AppData\Local\Temp\836F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\8505.tmp"C:\Users\Admin\AppData\Local\Temp\8505.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\85E0.tmp"C:\Users\Admin\AppData\Local\Temp\85E0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\864D.tmp"C:\Users\Admin\AppData\Local\Temp\864D.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\8831.tmp"C:\Users\Admin\AppData\Local\Temp\8831.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\89C8.tmp"C:\Users\Admin\AppData\Local\Temp\89C8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\8A83.tmp"C:\Users\Admin\AppData\Local\Temp\8A83.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\8D04.tmp"C:\Users\Admin\AppData\Local\Temp\8D04.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\909E.tmp"C:\Users\Admin\AppData\Local\Temp\909E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\9159.tmp"C:\Users\Admin\AppData\Local\Temp\9159.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\91C6.tmp"C:\Users\Admin\AppData\Local\Temp\91C6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\9263.tmp"C:\Users\Admin\AppData\Local\Temp\9263.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\932E.tmp"C:\Users\Admin\AppData\Local\Temp\932E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\93CA.tmp"C:\Users\Admin\AppData\Local\Temp\93CA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\9466.tmp"C:\Users\Admin\AppData\Local\Temp\9466.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\9522.tmp"C:\Users\Admin\AppData\Local\Temp\9522.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\960C.tmp"C:\Users\Admin\AppData\Local\Temp\960C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\9735.tmp"C:\Users\Admin\AppData\Local\Temp\9735.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\97C2.tmp"C:\Users\Admin\AppData\Local\Temp\97C2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\987D.tmp"C:\Users\Admin\AppData\Local\Temp\987D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\9958.tmp"C:\Users\Admin\AppData\Local\Temp\9958.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\99E5.tmp"C:\Users\Admin\AppData\Local\Temp\99E5.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\9BAA.tmp"C:\Users\Admin\AppData\Local\Temp\9BAA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\9C36.tmp"C:\Users\Admin\AppData\Local\Temp\9C36.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\9D21.tmp"C:\Users\Admin\AppData\Local\Temp\9D21.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\9E4A.tmp"C:\Users\Admin\AppData\Local\Temp\9E4A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\9ED6.tmp"C:\Users\Admin\AppData\Local\Temp\9ED6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\9F72.tmp"C:\Users\Admin\AppData\Local\Temp\9F72.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\A02E.tmp"C:\Users\Admin\AppData\Local\Temp\A02E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\A118.tmp"C:\Users\Admin\AppData\Local\Temp\A118.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\A195.tmp"C:\Users\Admin\AppData\Local\Temp\A195.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\A232.tmp"C:\Users\Admin\AppData\Local\Temp\A232.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\A29F.tmp"C:\Users\Admin\AppData\Local\Temp\A29F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\A426.tmp"C:\Users\Admin\AppData\Local\Temp\A426.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\A4C2.tmp"C:\Users\Admin\AppData\Local\Temp\A4C2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\A56E.tmp"C:\Users\Admin\AppData\Local\Temp\A56E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\A5DB.tmp"C:\Users\Admin\AppData\Local\Temp\A5DB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\A781.tmp"C:\Users\Admin\AppData\Local\Temp\A781.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\A86B.tmp"C:\Users\Admin\AppData\Local\Temp\A86B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\AA21.tmp"C:\Users\Admin\AppData\Local\Temp\AA21.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\AABD.tmp"C:\Users\Admin\AppData\Local\Temp\AABD.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\AB2A.tmp"C:\Users\Admin\AppData\Local\Temp\AB2A.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"66⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\AC24.tmp"C:\Users\Admin\AppData\Local\Temp\AC24.tmp"67⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"68⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"69⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"70⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\AE28.tmp"C:\Users\Admin\AppData\Local\Temp\AE28.tmp"71⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"72⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\AF70.tmp"C:\Users\Admin\AppData\Local\Temp\AF70.tmp"73⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"74⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\B07A.tmp"C:\Users\Admin\AppData\Local\Temp\B07A.tmp"75⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"76⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"77⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"78⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"79⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"80⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\B404.tmp"C:\Users\Admin\AppData\Local\Temp\B404.tmp"82⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\B491.tmp"C:\Users\Admin\AppData\Local\Temp\B491.tmp"83⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\B55C.tmp"C:\Users\Admin\AppData\Local\Temp\B55C.tmp"84⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"85⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\B656.tmp"C:\Users\Admin\AppData\Local\Temp\B656.tmp"86⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"87⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\B76F.tmp"C:\Users\Admin\AppData\Local\Temp\B76F.tmp"88⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"89⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\B898.tmp"C:\Users\Admin\AppData\Local\Temp\B898.tmp"90⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\B925.tmp"C:\Users\Admin\AppData\Local\Temp\B925.tmp"91⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"92⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"93⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\BB28.tmp"C:\Users\Admin\AppData\Local\Temp\BB28.tmp"94⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\BB96.tmp"C:\Users\Admin\AppData\Local\Temp\BB96.tmp"95⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\BC32.tmp"C:\Users\Admin\AppData\Local\Temp\BC32.tmp"96⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\BCBE.tmp"C:\Users\Admin\AppData\Local\Temp\BCBE.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\BD4B.tmp"C:\Users\Admin\AppData\Local\Temp\BD4B.tmp"98⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"99⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\BE45.tmp"C:\Users\Admin\AppData\Local\Temp\BE45.tmp"100⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\BED2.tmp"C:\Users\Admin\AppData\Local\Temp\BED2.tmp"101⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"102⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"103⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\C039.tmp"C:\Users\Admin\AppData\Local\Temp\C039.tmp"104⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\C097.tmp"C:\Users\Admin\AppData\Local\Temp\C097.tmp"105⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\C123.tmp"C:\Users\Admin\AppData\Local\Temp\C123.tmp"106⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"107⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"108⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"109⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\C375.tmp"C:\Users\Admin\AppData\Local\Temp\C375.tmp"110⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\C402.tmp"C:\Users\Admin\AppData\Local\Temp\C402.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\C47F.tmp"C:\Users\Admin\AppData\Local\Temp\C47F.tmp"112⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"113⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\C579.tmp"C:\Users\Admin\AppData\Local\Temp\C579.tmp"114⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\C605.tmp"C:\Users\Admin\AppData\Local\Temp\C605.tmp"115⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\C692.tmp"C:\Users\Admin\AppData\Local\Temp\C692.tmp"116⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"117⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\C76D.tmp"C:\Users\Admin\AppData\Local\Temp\C76D.tmp"118⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\C828.tmp"C:\Users\Admin\AppData\Local\Temp\C828.tmp"119⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"120⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\C942.tmp"C:\Users\Admin\AppData\Local\Temp\C942.tmp"121⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"122⤵PID:2552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-