Analysis
- max time kernel
127s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_000f4bdb0531d891df1df28b0242d76a_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_000f4bdb0531d891df1df28b0242d76a_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_000f4bdb0531d891df1df28b0242d76a_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-eb7pdstepd
- SHA256 cdc0d57bcd0436ee7ce07dfade731b9c8881431890b0fe151ea9840d266d56e4
- MD5 000f4bdb0531d891df1df28b0242d76a
- SHA1 55647f987a3ae8d553ab76fbe3a81f1b2663d656
- SHA512 50112b1cedacc18e95c22339850e60d0e15dcac86f20419d608d8d9885abbe77bf8fad782c31236cfa89f4439a800cd2f9468106d78e15712f19133fb40ced63
- SSDEEP 12288:wU5rCOTeiDapNKBuDoljqbOYdxbYY9VOCsWVNZ+3/v+I9hUG2VA:wUQOJD0wBuMl0X5LNGEA
- TLSH T145E4D02073D88532E9FB037859B5E6614D7EFD366722D6CF2B9016AE09B1BC09930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4156 7F58.tmp 2704 80AF.tmp 1232 82E2.tmp 4176 83EC.tmp 1712 84D6.tmp 4328 860E.tmp 2252 8728.tmp 5012 8831.tmp 1188 8989.tmp 4980 8A83.tmp 5540 8BCB.tmp 5808 8D23.tmp 2772 8E7B.tmp 1320 8F75.tmp 804 909E.tmp 2612 91D6.tmp 1384 932E.tmp 1152 9447.tmp 5280 959F.tmp 5712 96C8.tmp 5208 9810.tmp 708 9958.tmp 5236 9A90.tmp 2468 9B7B.tmp 5872 9CA4.tmp 1040 9D6F.tmp 828 9E88.tmp 1168 9FFF.tmp 2024 A147.tmp 3008 A241.tmp 3412 A36A.tmp 2368 A454.tmp 3648 A58D.tmp 5168 A60A.tmp 5196 A723.tmp 2500 A7CF.tmp 3772 A8AA.tmp 3708 A956.tmp 4812 AA30.tmp 5948 AABD.tmp 5492 AB88.tmp 5404 AC34.tmp 4544 ACF0.tmp 5284 AD6D.tmp 4152 ADF9.tmp 6128 AE95.tmp 1096 AF03.tmp 3592 AF9F.tmp 5016 B01C.tmp 2076 B089.tmp 2320 B0F7.tmp 3020 B1A3.tmp 4228 B22F.tmp 4268 B2CC.tmp 3248 B358.tmp 3704 B3F4.tmp 3744 B471.tmp 5984 B4FE.tmp 1412 B58B.tmp 1588 B608.tmp 4308 B6A4.tmp 1312 B721.tmp 1744 B7BD.tmp 4104 B84A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E61B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 493A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 221B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 563F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E40D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 594D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 691B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 510F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9711.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 687A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 883C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 835A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_000f4bdb0531d891df1df28b0242d76a_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 282A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 905A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B608.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6140 wrote to memory of 4156 6140 2026-08-02_000f4bdb0531d891df1df28b0242d76a_elex_mafia_stealc_tofsee.exe 89 PID 4156 wrote to memory of 2704 4156 7F58.tmp 90 PID 2704 wrote to memory of 1232 2704 80AF.tmp 91 PID 1232 wrote to memory of 4176 1232 82E2.tmp 92 PID 4176 wrote to memory of 1712 4176 83EC.tmp 93 PID 1712 wrote to memory of 4328 1712 84D6.tmp 94 PID 4328 wrote to memory of 2252 4328 860E.tmp 95 PID 2252 wrote to memory of 5012 2252 8728.tmp 96 PID 5012 wrote to memory of 1188 5012 8831.tmp 97 PID 1188 wrote to memory of 4980 1188 8989.tmp 98 PID 4980 wrote to memory of 5540 4980 8A83.tmp 99 PID 5540 wrote to memory of 5808 5540 8BCB.tmp 100 PID 5808 wrote to memory of 2772 5808 8D23.tmp 101 PID 2772 wrote to memory of 1320 2772 8E7B.tmp 102 PID 1320 wrote to memory of 804 1320 8F75.tmp 103 PID 804 wrote to memory of 2612 804 909E.tmp 104 PID 2612 wrote to memory of 1384 2612 91D6.tmp 105 PID 1384 wrote to memory of 1152 1384 932E.tmp 106 PID 1152 wrote to memory of 5280 1152 9447.tmp 107 PID 5280 wrote to memory of 5712 5280 959F.tmp 108 PID 5712 wrote to memory of 5208 5712 96C8.tmp 109 PID 5208 wrote to memory of 708 5208 9810.tmp 110 PID 708 wrote to memory of 5236 708 9958.tmp 111 PID 5236 wrote to memory of 2468 5236 9A90.tmp 112 PID 2468 wrote to memory of 5872 2468 9B7B.tmp 113 PID 5872 wrote to memory of 1040 5872 9CA4.tmp 114 PID 1040 wrote to memory of 828 1040 9D6F.tmp 115 PID 828 wrote to memory of 1168 828 9E88.tmp 116 PID 1168 wrote to memory of 2024 1168 9FFF.tmp 117 PID 2024 wrote to memory of 3008 2024 A147.tmp 118 PID 3008 wrote to memory of 3412 3008 A241.tmp 119 PID 3412 wrote to memory of 2368 3412 A36A.tmp 120 PID 2368 wrote to memory of 3648 2368 A454.tmp 121 PID 3648 wrote to memory of 5168 3648 A58D.tmp 122 PID 5168 wrote to memory of 5196 5168 A60A.tmp 123 PID 5196 wrote to memory of 2500 5196 A723.tmp 124 PID 2500 wrote to memory of 3772 2500 A7CF.tmp 125 PID 3772 wrote to memory of 3708 3772 A8AA.tmp 126 PID 3708 wrote to memory of 4812 3708 A956.tmp 127 PID 4812 wrote to memory of 5948 4812 AA30.tmp 128 PID 5948 wrote to memory of 5492 5948 AABD.tmp 129 PID 5492 wrote to memory of 5404 5492 AB88.tmp 130 PID 5404 wrote to memory of 4544 5404 AC34.tmp 131 PID 4544 wrote to memory of 5284 4544 ACF0.tmp 132 PID 5284 wrote to memory of 4152 5284 AD6D.tmp 133 PID 4152 wrote to memory of 6128 4152 ADF9.tmp 134 PID 6128 wrote to memory of 1096 6128 AE95.tmp 135 PID 1096 wrote to memory of 3592 1096 AF03.tmp 136 PID 3592 wrote to memory of 5016 3592 AF9F.tmp 137 PID 5016 wrote to memory of 2076 5016 B01C.tmp 138 PID 2076 wrote to memory of 2320 2076 B089.tmp 139 PID 2320 wrote to memory of 3020 2320 B0F7.tmp 140 PID 3020 wrote to memory of 4228 3020 B1A3.tmp 141 PID 4228 wrote to memory of 4268 4228 B22F.tmp 142 PID 4268 wrote to memory of 3248 4268 B2CC.tmp 143 PID 3248 wrote to memory of 3704 3248 B358.tmp 144 PID 3704 wrote to memory of 3744 3704 B3F4.tmp 145 PID 3744 wrote to memory of 5984 3744 B471.tmp 146 PID 5984 wrote to memory of 1412 5984 B4FE.tmp 147 PID 1412 wrote to memory of 1588 1412 B58B.tmp 148 PID 1588 wrote to memory of 4308 1588 B608.tmp 149 PID 4308 wrote to memory of 1312 4308 B6A4.tmp 150 PID 1312 wrote to memory of 1744 1312 B721.tmp 151 PID 1744 wrote to memory of 4104 1744 B7BD.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_000f4bdb0531d891df1df28b0242d76a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_000f4bdb0531d891df1df28b0242d76a_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\7F58.tmp"C:\Users\Admin\AppData\Local\Temp\7F58.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\80AF.tmp"C:\Users\Admin\AppData\Local\Temp\80AF.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\82E2.tmp"C:\Users\Admin\AppData\Local\Temp\82E2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\84D6.tmp"C:\Users\Admin\AppData\Local\Temp\84D6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\860E.tmp"C:\Users\Admin\AppData\Local\Temp\860E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\8728.tmp"C:\Users\Admin\AppData\Local\Temp\8728.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\8831.tmp"C:\Users\Admin\AppData\Local\Temp\8831.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\8989.tmp"C:\Users\Admin\AppData\Local\Temp\8989.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\8A83.tmp"C:\Users\Admin\AppData\Local\Temp\8A83.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\8F75.tmp"C:\Users\Admin\AppData\Local\Temp\8F75.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\909E.tmp"C:\Users\Admin\AppData\Local\Temp\909E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\91D6.tmp"C:\Users\Admin\AppData\Local\Temp\91D6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\932E.tmp"C:\Users\Admin\AppData\Local\Temp\932E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\9447.tmp"C:\Users\Admin\AppData\Local\Temp\9447.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\959F.tmp"C:\Users\Admin\AppData\Local\Temp\959F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\96C8.tmp"C:\Users\Admin\AppData\Local\Temp\96C8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\9810.tmp"C:\Users\Admin\AppData\Local\Temp\9810.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\9958.tmp"C:\Users\Admin\AppData\Local\Temp\9958.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\9A90.tmp"C:\Users\Admin\AppData\Local\Temp\9A90.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\9B7B.tmp"C:\Users\Admin\AppData\Local\Temp\9B7B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\9E88.tmp"C:\Users\Admin\AppData\Local\Temp\9E88.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\A147.tmp"C:\Users\Admin\AppData\Local\Temp\A147.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\A241.tmp"C:\Users\Admin\AppData\Local\Temp\A241.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\A36A.tmp"C:\Users\Admin\AppData\Local\Temp\A36A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\A454.tmp"C:\Users\Admin\AppData\Local\Temp\A454.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\A58D.tmp"C:\Users\Admin\AppData\Local\Temp\A58D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\A60A.tmp"C:\Users\Admin\AppData\Local\Temp\A60A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\A723.tmp"C:\Users\Admin\AppData\Local\Temp\A723.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\A956.tmp"C:\Users\Admin\AppData\Local\Temp\A956.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\AA30.tmp"C:\Users\Admin\AppData\Local\Temp\AA30.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\AABD.tmp"C:\Users\Admin\AppData\Local\Temp\AABD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\AB88.tmp"C:\Users\Admin\AppData\Local\Temp\AB88.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\AC34.tmp"C:\Users\Admin\AppData\Local\Temp\AC34.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\AE95.tmp"C:\Users\Admin\AppData\Local\Temp\AE95.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\AF03.tmp"C:\Users\Admin\AppData\Local\Temp\AF03.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\B01C.tmp"C:\Users\Admin\AppData\Local\Temp\B01C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\B089.tmp"C:\Users\Admin\AppData\Local\Temp\B089.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\B2CC.tmp"C:\Users\Admin\AppData\Local\Temp\B2CC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\B58B.tmp"C:\Users\Admin\AppData\Local\Temp\B58B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\B608.tmp"C:\Users\Admin\AppData\Local\Temp\B608.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\B721.tmp"C:\Users\Admin\AppData\Local\Temp\B721.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\B84A.tmp"C:\Users\Admin\AppData\Local\Temp\B84A.tmp"65⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"66⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\B992.tmp"C:\Users\Admin\AppData\Local\Temp\B992.tmp"67⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"68⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\BACA.tmp"C:\Users\Admin\AppData\Local\Temp\BACA.tmp"69⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\BB67.tmp"C:\Users\Admin\AppData\Local\Temp\BB67.tmp"70⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\BC03.tmp"C:\Users\Admin\AppData\Local\Temp\BC03.tmp"71⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\BC90.tmp"C:\Users\Admin\AppData\Local\Temp\BC90.tmp"72⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"73⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\BDB8.tmp"C:\Users\Admin\AppData\Local\Temp\BDB8.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\BE35.tmp"C:\Users\Admin\AppData\Local\Temp\BE35.tmp"75⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"76⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\BF20.tmp"C:\Users\Admin\AppData\Local\Temp\BF20.tmp"77⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"78⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\C029.tmp"C:\Users\Admin\AppData\Local\Temp\C029.tmp"79⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"80⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\C133.tmp"C:\Users\Admin\AppData\Local\Temp\C133.tmp"81⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"82⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"83⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"84⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\C375.tmp"C:\Users\Admin\AppData\Local\Temp\C375.tmp"85⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"86⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\C46F.tmp"C:\Users\Admin\AppData\Local\Temp\C46F.tmp"87⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\C51B.tmp"C:\Users\Admin\AppData\Local\Temp\C51B.tmp"88⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"89⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\C625.tmp"C:\Users\Admin\AppData\Local\Temp\C625.tmp"90⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\C6C1.tmp"C:\Users\Admin\AppData\Local\Temp\C6C1.tmp"91⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\C73E.tmp"C:\Users\Admin\AppData\Local\Temp\C73E.tmp"92⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"93⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\C857.tmp"C:\Users\Admin\AppData\Local\Temp\C857.tmp"94⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"95⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\C951.tmp"C:\Users\Admin\AppData\Local\Temp\C951.tmp"96⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"97⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\CA7A.tmp"C:\Users\Admin\AppData\Local\Temp\CA7A.tmp"98⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\CB26.tmp"C:\Users\Admin\AppData\Local\Temp\CB26.tmp"99⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"100⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\CC3F.tmp"C:\Users\Admin\AppData\Local\Temp\CC3F.tmp"101⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\CCAD.tmp"C:\Users\Admin\AppData\Local\Temp\CCAD.tmp"102⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\CD39.tmp"C:\Users\Admin\AppData\Local\Temp\CD39.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"104⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\CE33.tmp"C:\Users\Admin\AppData\Local\Temp\CE33.tmp"105⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"106⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"107⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"108⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\D075.tmp"C:\Users\Admin\AppData\Local\Temp\D075.tmp"109⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"110⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\D160.tmp"C:\Users\Admin\AppData\Local\Temp\D160.tmp"111⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"112⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\D25A.tmp"C:\Users\Admin\AppData\Local\Temp\D25A.tmp"113⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"114⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\D363.tmp"C:\Users\Admin\AppData\Local\Temp\D363.tmp"115⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\D41F.tmp"C:\Users\Admin\AppData\Local\Temp\D41F.tmp"116⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\D49C.tmp"C:\Users\Admin\AppData\Local\Temp\D49C.tmp"117⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\D538.tmp"C:\Users\Admin\AppData\Local\Temp\D538.tmp"118⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"119⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\D690.tmp"C:\Users\Admin\AppData\Local\Temp\D690.tmp"120⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\D71C.tmp"C:\Users\Admin\AppData\Local\Temp\D71C.tmp"121⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"122⤵PID:924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-