Analysis
- max time kernel
128s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 12:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_e1db787b3774b722b44d9ed54f6a774d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_e1db787b3774b722b44d9ed54f6a774d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_e1db787b3774b722b44d9ed54f6a774d_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260801-ps8ywsbj2x
- SHA256 574e6878bd6feb9f18363f67c622e390de6c2484b30836ad046379ec9c4e501e
- MD5 e1db787b3774b722b44d9ed54f6a774d
- SHA1 6e8309480650b74197910e0922f204ab8ec51c30
- SHA512 07e822bd0993b6e0ef4914dddd3ebe9f358e1cf160c11e97d5c29b6fb66941e73f6871616b37f615533c634eafbb3aa662e75e226d906643a573017c399475d5
- SSDEEP 12288:9U5rCOTei6iCVuMHikCyWZM8iEOChArVNFqZoXWjdq:9UQOJ6iguMCuL3ChArVNFqqGh
- TLSH T17CC4F120B584C036E6D205354AE2FB72693ABC355726A4C77BC0B76E6FB12E29335317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5904 7AC4.tmp 4132 7B8F.tmp 4216 7C2B.tmp 2080 7D64.tmp 2668 7E5E.tmp 5628 7F0A.tmp 4528 7FB5.tmp 3576 8061.tmp 4552 81A9.tmp 1624 8265.tmp 4784 82E2.tmp 5920 835F.tmp 2936 83FB.tmp 5412 8497.tmp 1548 8524.tmp 3028 85E0.tmp 3772 868B.tmp 5020 8728.tmp 1168 87C4.tmp 4240 8860.tmp 4268 88FC.tmp 3268 89E7.tmp 1528 8A73.tmp 2128 8B10.tmp 3500 8C39.tmp 5820 8CE4.tmp 2540 8D90.tmp 1476 8E4C.tmp 2208 8EAA.tmp 2752 8F55.tmp 252 9030.tmp 5164 90EC.tmp 4140 9198.tmp 3272 9215.tmp 2500 9292.tmp 5980 931E.tmp 3180 939B.tmp 804 9428.tmp 1516 9495.tmp 2088 9512.tmp 4812 9580.tmp 5064 960C.tmp 6008 966A.tmp 3404 96E7.tmp 6076 9764.tmp 1944 97E1.tmp 4768 984E.tmp 4088 98CB.tmp 2768 9929.tmp 5124 9996.tmp 1820 9A33.tmp 1268 9AA0.tmp 3032 9B0D.tmp 5400 9B6B.tmp 6024 9BD9.tmp 5668 9C46.tmp 468 9CC3.tmp 4900 9D5F.tmp 5536 9DCD.tmp 5392 9E3A.tmp 2696 9EC7.tmp 4192 9F44.tmp 200 9FB1.tmp 2824 A04D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B52D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F53E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 905A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 132B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2220.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 277A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 761C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B220.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53D9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4720 wrote to memory of 5904 4720 2026-08-01_e1db787b3774b722b44d9ed54f6a774d_elex_mafia_stealc_tofsee.exe 89 PID 5904 wrote to memory of 4132 5904 7AC4.tmp 90 PID 4132 wrote to memory of 4216 4132 7B8F.tmp 91 PID 4216 wrote to memory of 2080 4216 7C2B.tmp 92 PID 2080 wrote to memory of 2668 2080 7D64.tmp 93 PID 2668 wrote to memory of 5628 2668 7E5E.tmp 94 PID 5628 wrote to memory of 4528 5628 7F0A.tmp 95 PID 4528 wrote to memory of 3576 4528 7FB5.tmp 96 PID 3576 wrote to memory of 4552 3576 8061.tmp 97 PID 4552 wrote to memory of 1624 4552 81A9.tmp 98 PID 1624 wrote to memory of 4784 1624 8265.tmp 99 PID 4784 wrote to memory of 5920 4784 82E2.tmp 100 PID 5920 wrote to memory of 2936 5920 835F.tmp 101 PID 2936 wrote to memory of 5412 2936 83FB.tmp 102 PID 5412 wrote to memory of 1548 5412 8497.tmp 103 PID 1548 wrote to memory of 3028 1548 8524.tmp 104 PID 3028 wrote to memory of 3772 3028 85E0.tmp 105 PID 3772 wrote to memory of 5020 3772 868B.tmp 106 PID 5020 wrote to memory of 1168 5020 8728.tmp 107 PID 1168 wrote to memory of 4240 1168 87C4.tmp 108 PID 4240 wrote to memory of 4268 4240 8860.tmp 109 PID 4268 wrote to memory of 3268 4268 88FC.tmp 110 PID 3268 wrote to memory of 1528 3268 89E7.tmp 111 PID 1528 wrote to memory of 2128 1528 8A73.tmp 112 PID 2128 wrote to memory of 3500 2128 8B10.tmp 113 PID 3500 wrote to memory of 5820 3500 8C39.tmp 114 PID 5820 wrote to memory of 2540 5820 8CE4.tmp 115 PID 2540 wrote to memory of 1476 2540 8D90.tmp 116 PID 1476 wrote to memory of 2208 1476 8E4C.tmp 117 PID 2208 wrote to memory of 2752 2208 8EAA.tmp 118 PID 2752 wrote to memory of 252 2752 8F55.tmp 119 PID 252 wrote to memory of 5164 252 9030.tmp 120 PID 5164 wrote to memory of 4140 5164 90EC.tmp 121 PID 4140 wrote to memory of 3272 4140 9198.tmp 122 PID 3272 wrote to memory of 2500 3272 9215.tmp 123 PID 2500 wrote to memory of 5980 2500 9292.tmp 124 PID 5980 wrote to memory of 3180 5980 931E.tmp 125 PID 3180 wrote to memory of 804 3180 939B.tmp 126 PID 804 wrote to memory of 1516 804 9428.tmp 127 PID 1516 wrote to memory of 2088 1516 9495.tmp 128 PID 2088 wrote to memory of 4812 2088 9512.tmp 129 PID 4812 wrote to memory of 5064 4812 9580.tmp 130 PID 5064 wrote to memory of 6008 5064 960C.tmp 131 PID 6008 wrote to memory of 3404 6008 966A.tmp 132 PID 3404 wrote to memory of 6076 3404 96E7.tmp 133 PID 6076 wrote to memory of 1944 6076 9764.tmp 134 PID 1944 wrote to memory of 4768 1944 97E1.tmp 135 PID 4768 wrote to memory of 4088 4768 984E.tmp 136 PID 4088 wrote to memory of 2768 4088 98CB.tmp 137 PID 2768 wrote to memory of 5124 2768 9929.tmp 138 PID 5124 wrote to memory of 1820 5124 9996.tmp 139 PID 1820 wrote to memory of 1268 1820 9A33.tmp 140 PID 1268 wrote to memory of 3032 1268 9AA0.tmp 141 PID 3032 wrote to memory of 5400 3032 9B0D.tmp 142 PID 5400 wrote to memory of 6024 5400 9B6B.tmp 143 PID 6024 wrote to memory of 5668 6024 9BD9.tmp 144 PID 5668 wrote to memory of 468 5668 9C46.tmp 145 PID 468 wrote to memory of 4900 468 9CC3.tmp 146 PID 4900 wrote to memory of 5536 4900 9D5F.tmp 147 PID 5536 wrote to memory of 5392 5536 9DCD.tmp 148 PID 5392 wrote to memory of 2696 5392 9E3A.tmp 149 PID 2696 wrote to memory of 4192 2696 9EC7.tmp 150 PID 4192 wrote to memory of 200 4192 9F44.tmp 151 PID 200 wrote to memory of 2824 200 9FB1.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_e1db787b3774b722b44d9ed54f6a774d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_e1db787b3774b722b44d9ed54f6a774d_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\7B8F.tmp"C:\Users\Admin\AppData\Local\Temp\7B8F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\7D64.tmp"C:\Users\Admin\AppData\Local\Temp\7D64.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\7E5E.tmp"C:\Users\Admin\AppData\Local\Temp\7E5E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\8061.tmp"C:\Users\Admin\AppData\Local\Temp\8061.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\82E2.tmp"C:\Users\Admin\AppData\Local\Temp\82E2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\835F.tmp"C:\Users\Admin\AppData\Local\Temp\835F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\83FB.tmp"C:\Users\Admin\AppData\Local\Temp\83FB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\8497.tmp"C:\Users\Admin\AppData\Local\Temp\8497.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\8524.tmp"C:\Users\Admin\AppData\Local\Temp\8524.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\85E0.tmp"C:\Users\Admin\AppData\Local\Temp\85E0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\868B.tmp"C:\Users\Admin\AppData\Local\Temp\868B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\8728.tmp"C:\Users\Admin\AppData\Local\Temp\8728.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\87C4.tmp"C:\Users\Admin\AppData\Local\Temp\87C4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\8860.tmp"C:\Users\Admin\AppData\Local\Temp\8860.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\88FC.tmp"C:\Users\Admin\AppData\Local\Temp\88FC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\9030.tmp"C:\Users\Admin\AppData\Local\Temp\9030.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\90EC.tmp"C:\Users\Admin\AppData\Local\Temp\90EC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\9198.tmp"C:\Users\Admin\AppData\Local\Temp\9198.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\9215.tmp"C:\Users\Admin\AppData\Local\Temp\9215.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\9292.tmp"C:\Users\Admin\AppData\Local\Temp\9292.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\931E.tmp"C:\Users\Admin\AppData\Local\Temp\931E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\939B.tmp"C:\Users\Admin\AppData\Local\Temp\939B.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\9428.tmp"C:\Users\Admin\AppData\Local\Temp\9428.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\9495.tmp"C:\Users\Admin\AppData\Local\Temp\9495.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\9512.tmp"C:\Users\Admin\AppData\Local\Temp\9512.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\9580.tmp"C:\Users\Admin\AppData\Local\Temp\9580.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\960C.tmp"C:\Users\Admin\AppData\Local\Temp\960C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\966A.tmp"C:\Users\Admin\AppData\Local\Temp\966A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\96E7.tmp"C:\Users\Admin\AppData\Local\Temp\96E7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\9764.tmp"C:\Users\Admin\AppData\Local\Temp\9764.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\97E1.tmp"C:\Users\Admin\AppData\Local\Temp\97E1.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\984E.tmp"C:\Users\Admin\AppData\Local\Temp\984E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\98CB.tmp"C:\Users\Admin\AppData\Local\Temp\98CB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\9996.tmp"C:\Users\Admin\AppData\Local\Temp\9996.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\9A33.tmp"C:\Users\Admin\AppData\Local\Temp\9A33.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\9C46.tmp"C:\Users\Admin\AppData\Local\Temp\9C46.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\9CC3.tmp"C:\Users\Admin\AppData\Local\Temp\9CC3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\9D5F.tmp"C:\Users\Admin\AppData\Local\Temp\9D5F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\9F44.tmp"C:\Users\Admin\AppData\Local\Temp\9F44.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\9FB1.tmp"C:\Users\Admin\AppData\Local\Temp\9FB1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\A04D.tmp"C:\Users\Admin\AppData\Local\Temp\A04D.tmp"65⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"66⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\A157.tmp"C:\Users\Admin\AppData\Local\Temp\A157.tmp"67⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"68⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\A241.tmp"C:\Users\Admin\AppData\Local\Temp\A241.tmp"69⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"70⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"71⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:800 -
C:\Users\Admin\AppData\Local\Temp\A445.tmp"C:\Users\Admin\AppData\Local\Temp\A445.tmp"73⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"74⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\A54E.tmp"C:\Users\Admin\AppData\Local\Temp\A54E.tmp"75⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\A5BC.tmp"C:\Users\Admin\AppData\Local\Temp\A5BC.tmp"76⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\A639.tmp"C:\Users\Admin\AppData\Local\Temp\A639.tmp"77⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\A6A6.tmp"C:\Users\Admin\AppData\Local\Temp\A6A6.tmp"78⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\A723.tmp"C:\Users\Admin\AppData\Local\Temp\A723.tmp"79⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"80⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\A85C.tmp"C:\Users\Admin\AppData\Local\Temp\A85C.tmp"81⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\A8D9.tmp"C:\Users\Admin\AppData\Local\Temp\A8D9.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:300 -
C:\Users\Admin\AppData\Local\Temp\A975.tmp"C:\Users\Admin\AppData\Local\Temp\A975.tmp"83⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\AA11.tmp"C:\Users\Admin\AppData\Local\Temp\AA11.tmp"84⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\AAAD.tmp"C:\Users\Admin\AppData\Local\Temp\AAAD.tmp"85⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"86⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"87⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\AC34.tmp"C:\Users\Admin\AppData\Local\Temp\AC34.tmp"88⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"89⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"90⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"91⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\AE47.tmp"C:\Users\Admin\AppData\Local\Temp\AE47.tmp"92⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"93⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\AF41.tmp"C:\Users\Admin\AppData\Local\Temp\AF41.tmp"94⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"95⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\B03B.tmp"C:\Users\Admin\AppData\Local\Temp\B03B.tmp"96⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"97⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\B135.tmp"C:\Users\Admin\AppData\Local\Temp\B135.tmp"98⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"99⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"101⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"102⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"103⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\B443.tmp"C:\Users\Admin\AppData\Local\Temp\B443.tmp"104⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"105⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\B52D.tmp"C:\Users\Admin\AppData\Local\Temp\B52D.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\B5AA.tmp"C:\Users\Admin\AppData\Local\Temp\B5AA.tmp"107⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\B637.tmp"C:\Users\Admin\AppData\Local\Temp\B637.tmp"108⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"109⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\B77F.tmp"C:\Users\Admin\AppData\Local\Temp\B77F.tmp"110⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\B80B.tmp"C:\Users\Admin\AppData\Local\Temp\B80B.tmp"111⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"112⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\B934.tmp"C:\Users\Admin\AppData\Local\Temp\B934.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"114⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"115⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\BABB.tmp"C:\Users\Admin\AppData\Local\Temp\BABB.tmp"116⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\BB47.tmp"C:\Users\Admin\AppData\Local\Temp\BB47.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"118⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\BC51.tmp"C:\Users\Admin\AppData\Local\Temp\BC51.tmp"119⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"120⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\BD4B.tmp"C:\Users\Admin\AppData\Local\Temp\BD4B.tmp"121⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"122⤵PID:4084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-