Analysis
- max time kernel
126s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 02:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_828b52b530cac7c1466028bfe10b8a14_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_828b52b530cac7c1466028bfe10b8a14_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_828b52b530cac7c1466028bfe10b8a14_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-dfenqscj9s
- SHA256 f5fe77033260a53c6279d27f5e7fbaf53d7f7cf2e07175f2f96771c391549503
- MD5 828b52b530cac7c1466028bfe10b8a14
- SHA1 987a51d8aeb30bc0c384c106f8d428c78b6aff2f
- SHA512 3b8f047808b836601d680baad0420f09159b1cfdc9dddb5a9b9ee9c0454ff5faf9461da07c6ce29c2d5cfdc5c5ea7beb6f6b996a550788f5627cb1c3e50589db
- SSDEEP 12288:wU5rCOTeiDzXZLmmwBJAZdshWSKNdNZ+3/v+I9hUG2VA:wUQOJDzXJfw2HNGEA
- TLSH T1A8E4D02177D88636E9F7037859B5E6604D7EBD32A722D6CF5F8051AE0A71BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4608 EA27.tmp 3184 EAC4.tmp 5960 EC0C.tmp 4976 ED06.tmp 5544 EE0F.tmp 1804 EE8C.tmp 5416 EF96.tmp 3804 F0AF.tmp 4144 F1E8.tmp 4548 F2B3.tmp 2308 F3CC.tmp 1348 F4D6.tmp 5044 F5B1.tmp 1652 F69B.tmp 2660 F785.tmp 5088 F850.tmp 2852 F96A.tmp 2116 FA73.tmp 5864 FB5E.tmp 4576 FC48.tmp 5096 FD23.tmp 1484 FDFE.tmp 2484 FEE8.tmp 5336 20.tmp 1980 11A.tmp 3176 205.tmp 5356 30E.tmp 5092 437.tmp 2972 522.tmp 992 5ED.tmp 200 6D7.tmp 1620 7E1.tmp 4156 89C.tmp 2500 958.tmp 4276 9E4.tmp 5376 AB0.tmp 2332 B2D.tmp 1856 BE8.tmp 1840 C94.tmp 1152 D40.tmp 5340 DFB.tmp 2304 EC6.tmp 5932 F82.tmp 1188 104D.tmp 4188 10E9.tmp 5988 1186.tmp 5432 1231.tmp 1240 12DD.tmp 4676 134B.tmp 5916 1445.tmp 2924 14D1.tmp 2424 154E.tmp 1088 15CB.tmp 4032 1668.tmp 2432 16D5.tmp 3268 1752.tmp 1768 17DF.tmp 4532 184C.tmp 5392 18C9.tmp 5068 1946.tmp 4088 19B3.tmp 2912 1A21.tmp 5884 1AAD.tmp 2580 1B3A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9319.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A895.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 801E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C521.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B840.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C58F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 636E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C698.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C64F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C437.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3411.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4458.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F54E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8096.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9883.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B519.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1256 wrote to memory of 4608 1256 2026-08-02_828b52b530cac7c1466028bfe10b8a14_elex_mafia_stealc_tofsee.exe 89 PID 4608 wrote to memory of 3184 4608 EA27.tmp 90 PID 3184 wrote to memory of 5960 3184 EAC4.tmp 91 PID 5960 wrote to memory of 4976 5960 EC0C.tmp 92 PID 4976 wrote to memory of 5544 4976 ED06.tmp 93 PID 5544 wrote to memory of 1804 5544 EE0F.tmp 94 PID 1804 wrote to memory of 5416 1804 EE8C.tmp 95 PID 5416 wrote to memory of 3804 5416 EF96.tmp 96 PID 3804 wrote to memory of 4144 3804 F0AF.tmp 97 PID 4144 wrote to memory of 4548 4144 F1E8.tmp 98 PID 4548 wrote to memory of 2308 4548 F2B3.tmp 99 PID 2308 wrote to memory of 1348 2308 F3CC.tmp 100 PID 1348 wrote to memory of 5044 1348 F4D6.tmp 101 PID 5044 wrote to memory of 1652 5044 F5B1.tmp 102 PID 1652 wrote to memory of 2660 1652 F69B.tmp 103 PID 2660 wrote to memory of 5088 2660 F785.tmp 104 PID 5088 wrote to memory of 2852 5088 F850.tmp 105 PID 2852 wrote to memory of 2116 2852 F96A.tmp 106 PID 2116 wrote to memory of 5864 2116 FA73.tmp 107 PID 5864 wrote to memory of 4576 5864 FB5E.tmp 108 PID 4576 wrote to memory of 5096 4576 FC48.tmp 109 PID 5096 wrote to memory of 1484 5096 FD23.tmp 110 PID 1484 wrote to memory of 2484 1484 FDFE.tmp 111 PID 2484 wrote to memory of 5336 2484 FEE8.tmp 112 PID 5336 wrote to memory of 1980 5336 20.tmp 113 PID 1980 wrote to memory of 3176 1980 11A.tmp 114 PID 3176 wrote to memory of 5356 3176 205.tmp 115 PID 5356 wrote to memory of 5092 5356 30E.tmp 116 PID 5092 wrote to memory of 2972 5092 437.tmp 117 PID 2972 wrote to memory of 992 2972 522.tmp 118 PID 992 wrote to memory of 200 992 5ED.tmp 119 PID 200 wrote to memory of 1620 200 6D7.tmp 120 PID 1620 wrote to memory of 4156 1620 7E1.tmp 121 PID 4156 wrote to memory of 2500 4156 89C.tmp 122 PID 2500 wrote to memory of 4276 2500 958.tmp 123 PID 4276 wrote to memory of 5376 4276 9E4.tmp 124 PID 5376 wrote to memory of 2332 5376 AB0.tmp 125 PID 2332 wrote to memory of 1856 2332 B2D.tmp 126 PID 1856 wrote to memory of 1840 1856 BE8.tmp 127 PID 1840 wrote to memory of 1152 1840 C94.tmp 128 PID 1152 wrote to memory of 5340 1152 D40.tmp 129 PID 5340 wrote to memory of 2304 5340 DFB.tmp 130 PID 2304 wrote to memory of 5932 2304 EC6.tmp 131 PID 5932 wrote to memory of 1188 5932 F82.tmp 132 PID 1188 wrote to memory of 4188 1188 104D.tmp 133 PID 4188 wrote to memory of 5988 4188 10E9.tmp 134 PID 5988 wrote to memory of 5432 5988 1186.tmp 135 PID 5432 wrote to memory of 1240 5432 1231.tmp 136 PID 1240 wrote to memory of 4676 1240 12DD.tmp 137 PID 5684 wrote to memory of 5916 5684 13C8.tmp 139 PID 5916 wrote to memory of 2924 5916 1445.tmp 140 PID 2924 wrote to memory of 2424 2924 14D1.tmp 141 PID 2424 wrote to memory of 1088 2424 154E.tmp 142 PID 1088 wrote to memory of 4032 1088 15CB.tmp 143 PID 4032 wrote to memory of 2432 4032 1668.tmp 144 PID 2432 wrote to memory of 3268 2432 16D5.tmp 145 PID 3268 wrote to memory of 1768 3268 1752.tmp 146 PID 1768 wrote to memory of 4532 1768 17DF.tmp 147 PID 4532 wrote to memory of 5392 4532 184C.tmp 148 PID 5392 wrote to memory of 5068 5392 18C9.tmp 149 PID 5068 wrote to memory of 4088 5068 1946.tmp 150 PID 4088 wrote to memory of 2912 4088 19B3.tmp 151 PID 2912 wrote to memory of 5884 2912 1A21.tmp 152 PID 5884 wrote to memory of 2580 5884 1AAD.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_828b52b530cac7c1466028bfe10b8a14_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_828b52b530cac7c1466028bfe10b8a14_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\EA27.tmp"C:\Users\Admin\AppData\Local\Temp\EA27.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\EC0C.tmp"C:\Users\Admin\AppData\Local\Temp\EC0C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\ED06.tmp"C:\Users\Admin\AppData\Local\Temp\ED06.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\EF96.tmp"C:\Users\Admin\AppData\Local\Temp\EF96.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\F2B3.tmp"C:\Users\Admin\AppData\Local\Temp\F2B3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\F69B.tmp"C:\Users\Admin\AppData\Local\Temp\F69B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\F785.tmp"C:\Users\Admin\AppData\Local\Temp\F785.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\F850.tmp"C:\Users\Admin\AppData\Local\Temp\F850.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\F96A.tmp"C:\Users\Admin\AppData\Local\Temp\F96A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\FA73.tmp"C:\Users\Admin\AppData\Local\Temp\FA73.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\FC48.tmp"C:\Users\Admin\AppData\Local\Temp\FC48.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\FD23.tmp"C:\Users\Admin\AppData\Local\Temp\FD23.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\20.tmp"C:\Users\Admin\AppData\Local\Temp\20.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\11A.tmp"C:\Users\Admin\AppData\Local\Temp\11A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\205.tmp"C:\Users\Admin\AppData\Local\Temp\205.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\30E.tmp"C:\Users\Admin\AppData\Local\Temp\30E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\437.tmp"C:\Users\Admin\AppData\Local\Temp\437.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\5ED.tmp"C:\Users\Admin\AppData\Local\Temp\5ED.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\6D7.tmp"C:\Users\Admin\AppData\Local\Temp\6D7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\7E1.tmp"C:\Users\Admin\AppData\Local\Temp\7E1.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\89C.tmp"C:\Users\Admin\AppData\Local\Temp\89C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\958.tmp"C:\Users\Admin\AppData\Local\Temp\958.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\9E4.tmp"C:\Users\Admin\AppData\Local\Temp\9E4.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\AB0.tmp"C:\Users\Admin\AppData\Local\Temp\AB0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\B2D.tmp"C:\Users\Admin\AppData\Local\Temp\B2D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\BE8.tmp"C:\Users\Admin\AppData\Local\Temp\BE8.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\C94.tmp"C:\Users\Admin\AppData\Local\Temp\C94.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\D40.tmp"C:\Users\Admin\AppData\Local\Temp\D40.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\DFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\EC6.tmp"C:\Users\Admin\AppData\Local\Temp\EC6.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\F82.tmp"C:\Users\Admin\AppData\Local\Temp\F82.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\104D.tmp"C:\Users\Admin\AppData\Local\Temp\104D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\10E9.tmp"C:\Users\Admin\AppData\Local\Temp\10E9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\1186.tmp"C:\Users\Admin\AppData\Local\Temp\1186.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\1231.tmp"C:\Users\Admin\AppData\Local\Temp\1231.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\12DD.tmp"C:\Users\Admin\AppData\Local\Temp\12DD.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\134B.tmp"C:\Users\Admin\AppData\Local\Temp\134B.tmp"50⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\13C8.tmp"C:\Users\Admin\AppData\Local\Temp\13C8.tmp"51⤵
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\1445.tmp"C:\Users\Admin\AppData\Local\Temp\1445.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\14D1.tmp"C:\Users\Admin\AppData\Local\Temp\14D1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\154E.tmp"C:\Users\Admin\AppData\Local\Temp\154E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\15CB.tmp"C:\Users\Admin\AppData\Local\Temp\15CB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\1668.tmp"C:\Users\Admin\AppData\Local\Temp\1668.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\16D5.tmp"C:\Users\Admin\AppData\Local\Temp\16D5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1752.tmp"C:\Users\Admin\AppData\Local\Temp\1752.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\17DF.tmp"C:\Users\Admin\AppData\Local\Temp\17DF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\184C.tmp"C:\Users\Admin\AppData\Local\Temp\184C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\18C9.tmp"C:\Users\Admin\AppData\Local\Temp\18C9.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\1946.tmp"C:\Users\Admin\AppData\Local\Temp\1946.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\19B3.tmp"C:\Users\Admin\AppData\Local\Temp\19B3.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"67⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\1C53.tmp"C:\Users\Admin\AppData\Local\Temp\1C53.tmp"68⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\1CD0.tmp"C:\Users\Admin\AppData\Local\Temp\1CD0.tmp"69⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"70⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"71⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\1E66.tmp"C:\Users\Admin\AppData\Local\Temp\1E66.tmp"72⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"73⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\1F51.tmp"C:\Users\Admin\AppData\Local\Temp\1F51.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"75⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\204B.tmp"C:\Users\Admin\AppData\Local\Temp\204B.tmp"76⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"77⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"78⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\226E.tmp"C:\Users\Admin\AppData\Local\Temp\226E.tmp"79⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\22EB.tmp"C:\Users\Admin\AppData\Local\Temp\22EB.tmp"80⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"81⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"82⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"83⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"84⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"85⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"86⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"87⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\275F.tmp"C:\Users\Admin\AppData\Local\Temp\275F.tmp"88⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\27EC.tmp"C:\Users\Admin\AppData\Local\Temp\27EC.tmp"89⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2869.tmp"C:\Users\Admin\AppData\Local\Temp\2869.tmp"90⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\28F6.tmp"C:\Users\Admin\AppData\Local\Temp\28F6.tmp"91⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\2973.tmp"C:\Users\Admin\AppData\Local\Temp\2973.tmp"92⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\29FF.tmp"C:\Users\Admin\AppData\Local\Temp\29FF.tmp"93⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\2A9B.tmp"C:\Users\Admin\AppData\Local\Temp\2A9B.tmp"94⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2B18.tmp"C:\Users\Admin\AppData\Local\Temp\2B18.tmp"95⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\2B95.tmp"C:\Users\Admin\AppData\Local\Temp\2B95.tmp"96⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\2C03.tmp"C:\Users\Admin\AppData\Local\Temp\2C03.tmp"97⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\2C80.tmp"C:\Users\Admin\AppData\Local\Temp\2C80.tmp"98⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"99⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\2D99.tmp"C:\Users\Admin\AppData\Local\Temp\2D99.tmp"100⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\2E16.tmp"C:\Users\Admin\AppData\Local\Temp\2E16.tmp"101⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\2EA3.tmp"C:\Users\Admin\AppData\Local\Temp\2EA3.tmp"102⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\2F20.tmp"C:\Users\Admin\AppData\Local\Temp\2F20.tmp"103⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"104⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\301A.tmp"C:\Users\Admin\AppData\Local\Temp\301A.tmp"105⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\3097.tmp"C:\Users\Admin\AppData\Local\Temp\3097.tmp"106⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\3114.tmp"C:\Users\Admin\AppData\Local\Temp\3114.tmp"107⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\31A0.tmp"C:\Users\Admin\AppData\Local\Temp\31A0.tmp"108⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\322D.tmp"C:\Users\Admin\AppData\Local\Temp\322D.tmp"109⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\32AA.tmp"C:\Users\Admin\AppData\Local\Temp\32AA.tmp"110⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\3317.tmp"C:\Users\Admin\AppData\Local\Temp\3317.tmp"111⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3385.tmp"C:\Users\Admin\AppData\Local\Temp\3385.tmp"112⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\3411.tmp"C:\Users\Admin\AppData\Local\Temp\3411.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\347F.tmp"C:\Users\Admin\AppData\Local\Temp\347F.tmp"114⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\350B.tmp"C:\Users\Admin\AppData\Local\Temp\350B.tmp"115⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\35A8.tmp"C:\Users\Admin\AppData\Local\Temp\35A8.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:252 -
C:\Users\Admin\AppData\Local\Temp\3634.tmp"C:\Users\Admin\AppData\Local\Temp\3634.tmp"117⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\36C1.tmp"C:\Users\Admin\AppData\Local\Temp\36C1.tmp"118⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\374D.tmp"C:\Users\Admin\AppData\Local\Temp\374D.tmp"119⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\37CA.tmp"C:\Users\Admin\AppData\Local\Temp\37CA.tmp"120⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\3838.tmp"C:\Users\Admin\AppData\Local\Temp\3838.tmp"121⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\38B5.tmp"C:\Users\Admin\AppData\Local\Temp\38B5.tmp"122⤵PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-