Analysis
- max time kernel
132s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 03:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_4ed4ab7cec62720843b7b84c5d823213_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_4ed4ab7cec62720843b7b84c5d823213_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_4ed4ab7cec62720843b7b84c5d823213_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260801-dw4b2adn3z
- SHA256 73e028f595d3d560336f3716b392ebafb4b2eb67fe97b8ff37e6397b2c46abf9
- MD5 4ed4ab7cec62720843b7b84c5d823213
- SHA1 06a532d4d07d3dd23e578903973c00bc37f0b548
- SHA512 ec68db60f57750b1fc087260e16c020c889cb181bf3bc90c469ca594df155639e4eb1f07970e6b7b7c5d370c404a2f044f6464a98102200f4896ff33bf1d2ebd
- SSDEEP 6144:oorf3lPvovsgZnqG2C7mOTeiL/DL6KPsuB/enJ9t70MoD1hP4wAirgy3X4h5rfc8:NU5rCOTeijSuEnB7OfPD/Go/DZTZwlH
- TLSH T1B4B4E0257A45C033E69212704EE6EBB2693B7C315722A4C32794A77E2FB52E1E374347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5752 9F05.tmp 4160 9F92.tmp 5392 A09B.tmp 2924 A157.tmp 248 A1F3.tmp 1480 A260.tmp 1160 A32C.tmp 572 A3E7.tmp 5156 A493.tmp 5512 A5BC.tmp 2748 A723.tmp 1136 A7FE.tmp 3740 A8B9.tmp 4320 A936.tmp 3184 A9B3.tmp 2816 AA7F.tmp 4640 AB0B.tmp 5648 ABA7.tmp 1916 AC53.tmp 2444 AD3E.tmp 4184 ADCA.tmp 3744 AE67.tmp 2780 AEE4.tmp 2972 AF8F.tmp 1324 B03B.tmp 2396 B0C8.tmp 4600 B155.tmp 2376 B23F.tmp 2632 B2DB.tmp 2344 B377.tmp 4796 B404.tmp 3636 B4CF.tmp 4944 B55C.tmp 4768 B5D9.tmp 1844 B656.tmp 4264 B6B4.tmp 1504 B750.tmp 2660 B7CD.tmp 4780 B84A.tmp 5876 B8E6.tmp 4884 B973.tmp 1512 B9F0.tmp 3300 BA7C.tmp 5940 BB09.tmp 992 BB86.tmp 1360 BC13.tmp 1224 BC9F.tmp 5064 BD0D.tmp 5068 BD7A.tmp 2156 BDF7.tmp 5668 BE74.tmp 3768 BED2.tmp 1040 BF5E.tmp 964 BFCC.tmp 3948 C049.tmp 5708 C0D5.tmp 1892 C172.tmp 6068 C1FE.tmp 4260 C29A.tmp 5296 C327.tmp 5300 C3B4.tmp 5484 C46F.tmp 3584 C51B.tmp 2380 C5B7.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 158D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4756.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A961.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C72E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D037.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 160A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C049.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 632B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C29A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 464C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 273B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 344B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E296.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB86.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4004 wrote to memory of 5752 4004 2026-08-01_4ed4ab7cec62720843b7b84c5d823213_elex_mafia_stealc_tofsee.exe 89 PID 5752 wrote to memory of 4160 5752 9F05.tmp 90 PID 4160 wrote to memory of 5392 4160 9F92.tmp 91 PID 5392 wrote to memory of 2924 5392 A09B.tmp 92 PID 2924 wrote to memory of 248 2924 A157.tmp 93 PID 248 wrote to memory of 1480 248 A1F3.tmp 94 PID 1480 wrote to memory of 1160 1480 A260.tmp 95 PID 1160 wrote to memory of 572 1160 A32C.tmp 96 PID 572 wrote to memory of 5156 572 A3E7.tmp 97 PID 5156 wrote to memory of 5512 5156 A493.tmp 98 PID 5512 wrote to memory of 2748 5512 A5BC.tmp 99 PID 2748 wrote to memory of 1136 2748 A723.tmp 100 PID 1136 wrote to memory of 3740 1136 A7FE.tmp 101 PID 3740 wrote to memory of 4320 3740 A8B9.tmp 102 PID 4320 wrote to memory of 3184 4320 A936.tmp 103 PID 3184 wrote to memory of 2816 3184 A9B3.tmp 104 PID 2816 wrote to memory of 4640 2816 AA7F.tmp 105 PID 4640 wrote to memory of 5648 4640 AB0B.tmp 106 PID 5648 wrote to memory of 1916 5648 ABA7.tmp 107 PID 1916 wrote to memory of 2444 1916 AC53.tmp 108 PID 2444 wrote to memory of 4184 2444 AD3E.tmp 109 PID 4184 wrote to memory of 3744 4184 ADCA.tmp 110 PID 3744 wrote to memory of 2780 3744 AE67.tmp 111 PID 2780 wrote to memory of 2972 2780 AEE4.tmp 112 PID 2972 wrote to memory of 1324 2972 AF8F.tmp 113 PID 1324 wrote to memory of 2396 1324 B03B.tmp 114 PID 2396 wrote to memory of 4600 2396 B0C8.tmp 115 PID 4600 wrote to memory of 2376 4600 B155.tmp 116 PID 2376 wrote to memory of 2632 2376 B23F.tmp 117 PID 2632 wrote to memory of 2344 2632 B2DB.tmp 118 PID 2344 wrote to memory of 4796 2344 B377.tmp 119 PID 4796 wrote to memory of 3636 4796 B404.tmp 120 PID 3636 wrote to memory of 4944 3636 B4CF.tmp 121 PID 4944 wrote to memory of 4768 4944 B55C.tmp 122 PID 4768 wrote to memory of 1844 4768 B5D9.tmp 123 PID 1844 wrote to memory of 4264 1844 B656.tmp 124 PID 4264 wrote to memory of 1504 4264 B6B4.tmp 125 PID 1504 wrote to memory of 2660 1504 B750.tmp 126 PID 2660 wrote to memory of 4780 2660 B7CD.tmp 127 PID 4780 wrote to memory of 5876 4780 B84A.tmp 128 PID 5876 wrote to memory of 4884 5876 B8E6.tmp 129 PID 4884 wrote to memory of 1512 4884 B973.tmp 130 PID 1512 wrote to memory of 3300 1512 B9F0.tmp 131 PID 3300 wrote to memory of 5940 3300 BA7C.tmp 132 PID 5940 wrote to memory of 992 5940 BB09.tmp 133 PID 992 wrote to memory of 1360 992 BB86.tmp 134 PID 1360 wrote to memory of 1224 1360 BC13.tmp 135 PID 1224 wrote to memory of 5064 1224 BC9F.tmp 136 PID 5064 wrote to memory of 5068 5064 BD0D.tmp 137 PID 5068 wrote to memory of 2156 5068 BD7A.tmp 138 PID 2156 wrote to memory of 5668 2156 BDF7.tmp 139 PID 5668 wrote to memory of 3768 5668 BE74.tmp 140 PID 3768 wrote to memory of 1040 3768 BED2.tmp 141 PID 1040 wrote to memory of 964 1040 BF5E.tmp 142 PID 964 wrote to memory of 3948 964 BFCC.tmp 143 PID 3948 wrote to memory of 5708 3948 C049.tmp 144 PID 5708 wrote to memory of 1892 5708 C0D5.tmp 145 PID 1892 wrote to memory of 6068 1892 C172.tmp 146 PID 6068 wrote to memory of 4260 6068 C1FE.tmp 147 PID 4260 wrote to memory of 5296 4260 C29A.tmp 148 PID 5296 wrote to memory of 5300 5296 C327.tmp 149 PID 5300 wrote to memory of 5484 5300 C3B4.tmp 150 PID 5484 wrote to memory of 3584 5484 C46F.tmp 151 PID 3584 wrote to memory of 2380 3584 C51B.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_4ed4ab7cec62720843b7b84c5d823213_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_4ed4ab7cec62720843b7b84c5d823213_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\9F05.tmp"C:\Users\Admin\AppData\Local\Temp\9F05.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\9F92.tmp"C:\Users\Admin\AppData\Local\Temp\9F92.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\A09B.tmp"C:\Users\Admin\AppData\Local\Temp\A09B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\A157.tmp"C:\Users\Admin\AppData\Local\Temp\A157.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\A260.tmp"C:\Users\Admin\AppData\Local\Temp\A260.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\A32C.tmp"C:\Users\Admin\AppData\Local\Temp\A32C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\A493.tmp"C:\Users\Admin\AppData\Local\Temp\A493.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\A5BC.tmp"C:\Users\Admin\AppData\Local\Temp\A5BC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\A723.tmp"C:\Users\Admin\AppData\Local\Temp\A723.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\A7FE.tmp"C:\Users\Admin\AppData\Local\Temp\A7FE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\A936.tmp"C:\Users\Admin\AppData\Local\Temp\A936.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\AC53.tmp"C:\Users\Admin\AppData\Local\Temp\AC53.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\AE67.tmp"C:\Users\Admin\AppData\Local\Temp\AE67.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\AEE4.tmp"C:\Users\Admin\AppData\Local\Temp\AEE4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\B03B.tmp"C:\Users\Admin\AppData\Local\Temp\B03B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\B377.tmp"C:\Users\Admin\AppData\Local\Temp\B377.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\B404.tmp"C:\Users\Admin\AppData\Local\Temp\B404.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\B55C.tmp"C:\Users\Admin\AppData\Local\Temp\B55C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\B656.tmp"C:\Users\Admin\AppData\Local\Temp\B656.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\B750.tmp"C:\Users\Admin\AppData\Local\Temp\B750.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\B84A.tmp"C:\Users\Admin\AppData\Local\Temp\B84A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\B973.tmp"C:\Users\Admin\AppData\Local\Temp\B973.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\B9F0.tmp"C:\Users\Admin\AppData\Local\Temp\B9F0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\BB09.tmp"C:\Users\Admin\AppData\Local\Temp\BB09.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\BB86.tmp"C:\Users\Admin\AppData\Local\Temp\BB86.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\BC13.tmp"C:\Users\Admin\AppData\Local\Temp\BC13.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\BE74.tmp"C:\Users\Admin\AppData\Local\Temp\BE74.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\BED2.tmp"C:\Users\Admin\AppData\Local\Temp\BED2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\C049.tmp"C:\Users\Admin\AppData\Local\Temp\C049.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\C172.tmp"C:\Users\Admin\AppData\Local\Temp\C172.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\C1FE.tmp"C:\Users\Admin\AppData\Local\Temp\C1FE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\C29A.tmp"C:\Users\Admin\AppData\Local\Temp\C29A.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\C327.tmp"C:\Users\Admin\AppData\Local\Temp\C327.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\C3B4.tmp"C:\Users\Admin\AppData\Local\Temp\C3B4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\C46F.tmp"C:\Users\Admin\AppData\Local\Temp\C46F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\C51B.tmp"C:\Users\Admin\AppData\Local\Temp\C51B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\C644.tmp"C:\Users\Admin\AppData\Local\Temp\C644.tmp"66⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"67⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\C72E.tmp"C:\Users\Admin\AppData\Local\Temp\C72E.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\C79C.tmp"C:\Users\Admin\AppData\Local\Temp\C79C.tmp"69⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"70⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\C867.tmp"C:\Users\Admin\AppData\Local\Temp\C867.tmp"71⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"72⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\C951.tmp"C:\Users\Admin\AppData\Local\Temp\C951.tmp"73⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"74⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"76⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\CB26.tmp"C:\Users\Admin\AppData\Local\Temp\CB26.tmp"77⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"78⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\CC30.tmp"C:\Users\Admin\AppData\Local\Temp\CC30.tmp"79⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\CCAD.tmp"C:\Users\Admin\AppData\Local\Temp\CCAD.tmp"80⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\CD2A.tmp"C:\Users\Admin\AppData\Local\Temp\CD2A.tmp"81⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\CD97.tmp"C:\Users\Admin\AppData\Local\Temp\CD97.tmp"82⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\CE24.tmp"C:\Users\Admin\AppData\Local\Temp\CE24.tmp"83⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"84⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"85⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\CF9B.tmp"C:\Users\Admin\AppData\Local\Temp\CF9B.tmp"86⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\D037.tmp"C:\Users\Admin\AppData\Local\Temp\D037.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\D0A4.tmp"C:\Users\Admin\AppData\Local\Temp\D0A4.tmp"88⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\D121.tmp"C:\Users\Admin\AppData\Local\Temp\D121.tmp"89⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\D19E.tmp"C:\Users\Admin\AppData\Local\Temp\D19E.tmp"90⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\D21B.tmp"C:\Users\Admin\AppData\Local\Temp\D21B.tmp"91⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\D298.tmp"C:\Users\Admin\AppData\Local\Temp\D298.tmp"92⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\D315.tmp"C:\Users\Admin\AppData\Local\Temp\D315.tmp"93⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"94⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\D46D.tmp"C:\Users\Admin\AppData\Local\Temp\D46D.tmp"95⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"96⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\D596.tmp"C:\Users\Admin\AppData\Local\Temp\D596.tmp"97⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\D613.tmp"C:\Users\Admin\AppData\Local\Temp\D613.tmp"98⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\D690.tmp"C:\Users\Admin\AppData\Local\Temp\D690.tmp"99⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\D72C.tmp"C:\Users\Admin\AppData\Local\Temp\D72C.tmp"100⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"101⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\D816.tmp"C:\Users\Admin\AppData\Local\Temp\D816.tmp"102⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"103⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"104⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"105⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"106⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"107⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\DB43.tmp"C:\Users\Admin\AppData\Local\Temp\DB43.tmp"108⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\DBDF.tmp"C:\Users\Admin\AppData\Local\Temp\DBDF.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"110⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\DCD9.tmp"C:\Users\Admin\AppData\Local\Temp\DCD9.tmp"111⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\DD56.tmp"C:\Users\Admin\AppData\Local\Temp\DD56.tmp"112⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"113⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"114⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\DEEC.tmp"C:\Users\Admin\AppData\Local\Temp\DEEC.tmp"115⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"116⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"117⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\E054.tmp"C:\Users\Admin\AppData\Local\Temp\E054.tmp"118⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"119⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\E13E.tmp"C:\Users\Admin\AppData\Local\Temp\E13E.tmp"120⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"121⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\E229.tmp"C:\Users\Admin\AppData\Local\Temp\E229.tmp"122⤵PID:2496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-