Analysis
- max time kernel
124s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-eb9hzstepf
- SHA256 a3c13fe09611fc1626bd935daab9b270bb8b4b3d62079fde76c721265b577039
- MD5 000591b70e4af6a3af1719ecda4c9971
- SHA1 e9667cc602b6dcf0b571242a7d0e5060e83c6253
- SHA512 c93162e3227df9744c123aaa1a426573084e997e69b70e7f2516a6cca16097274fa5a5b0097b77414995db131193b1867f2c8e4330f88ef9b4f0497f1ce91ba7
- SSDEEP 12288:wU5rCOTeiDujrFdDqFI2y7jCt6lgxp9s1GGXNZ+3/v+I9hUG2VA:wUQOJDufFJCI546lksAGXNGEA
- TLSH T1D9E4E12173D8C536E5FB037859B5E660497EBD266722D6CF2F8016BE0AB1BC08631763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4636 B3E5.tmp 2884 B52D.tmp 5304 B6F2.tmp 2592 B7EC.tmp 264 B8D6.tmp 1744 B9C1.tmp 2844 BABB.tmp 2228 BBA5.tmp 1480 BCED.tmp 5632 BDE7.tmp 4296 BEF1.tmp 5116 BFEB.tmp 2948 C114.tmp 4944 C23D.tmp 5352 C394.tmp 3416 C47F.tmp 688 C588.tmp 1776 C673.tmp 2404 C73E.tmp 4188 C809.tmp 3924 C8E4.tmp 2448 C9DE.tmp 5924 CB07.tmp 2580 CC01.tmp 1708 CD1A.tmp 5220 CE04.tmp 3740 CEEF.tmp 2384 D008.tmp 4292 D102.tmp 2036 D23A.tmp 1036 D315.tmp 4328 D46D.tmp 3344 D5B5.tmp 3236 D661.tmp 2968 D71C.tmp 3928 D7C8.tmp 2696 D865.tmp 3276 D920.tmp 3976 D9CC.tmp 5848 DA97.tmp 2040 DB53.tmp 5236 DBEF.tmp 6128 DD37.tmp 4760 DDF2.tmp 2452 DEEC.tmp 2436 DFC7.tmp 5420 E083.tmp 3432 E11F.tmp 1484 E1AC.tmp 5996 E248.tmp 5276 E2C5.tmp 6036 E371.tmp 2324 E3FD.tmp 2296 E49A.tmp 4448 E517.tmp 4124 E5A3.tmp 4500 E63F.tmp 1748 E6EB.tmp 4900 E759.tmp 4600 E7F5.tmp 4016 E872.tmp 2780 E8DF.tmp 4736 E95C.tmp 1472 E9E9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D60E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D68B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 477A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6974.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 782A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 395C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D46D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C276.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D12C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4552.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7011.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7125.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 377C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6505.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 787D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 492B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 4636 3980 2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe 88 PID 4636 wrote to memory of 2884 4636 B3E5.tmp 89 PID 2884 wrote to memory of 5304 2884 B52D.tmp 90 PID 5304 wrote to memory of 2592 5304 B6F2.tmp 91 PID 2592 wrote to memory of 264 2592 B7EC.tmp 92 PID 264 wrote to memory of 1744 264 B8D6.tmp 93 PID 1744 wrote to memory of 2844 1744 B9C1.tmp 94 PID 2844 wrote to memory of 2228 2844 BABB.tmp 95 PID 2228 wrote to memory of 1480 2228 BBA5.tmp 96 PID 1480 wrote to memory of 5632 1480 BCED.tmp 97 PID 5632 wrote to memory of 4296 5632 BDE7.tmp 98 PID 4296 wrote to memory of 5116 4296 BEF1.tmp 99 PID 5116 wrote to memory of 2948 5116 BFEB.tmp 100 PID 2948 wrote to memory of 4944 2948 C114.tmp 101 PID 4944 wrote to memory of 5352 4944 C23D.tmp 102 PID 5352 wrote to memory of 3416 5352 C394.tmp 103 PID 3416 wrote to memory of 688 3416 C47F.tmp 104 PID 688 wrote to memory of 1776 688 C588.tmp 105 PID 1776 wrote to memory of 2404 1776 C673.tmp 106 PID 2404 wrote to memory of 4188 2404 C73E.tmp 107 PID 4188 wrote to memory of 3924 4188 C809.tmp 108 PID 3924 wrote to memory of 2448 3924 C8E4.tmp 109 PID 2448 wrote to memory of 5924 2448 C9DE.tmp 110 PID 5924 wrote to memory of 2580 5924 CB07.tmp 111 PID 2580 wrote to memory of 1708 2580 CC01.tmp 112 PID 1708 wrote to memory of 5220 1708 CD1A.tmp 113 PID 5220 wrote to memory of 3740 5220 CE04.tmp 114 PID 3740 wrote to memory of 2384 3740 CEEF.tmp 115 PID 2384 wrote to memory of 4292 2384 D008.tmp 116 PID 4292 wrote to memory of 2036 4292 D102.tmp 117 PID 2036 wrote to memory of 1036 2036 D23A.tmp 118 PID 1036 wrote to memory of 4328 1036 D315.tmp 119 PID 4328 wrote to memory of 3344 4328 D46D.tmp 120 PID 3344 wrote to memory of 3236 3344 D5B5.tmp 121 PID 3236 wrote to memory of 2968 3236 D661.tmp 122 PID 2968 wrote to memory of 3928 2968 D71C.tmp 123 PID 3928 wrote to memory of 2696 3928 D7C8.tmp 124 PID 2696 wrote to memory of 3276 2696 D865.tmp 125 PID 3276 wrote to memory of 3976 3276 D920.tmp 126 PID 3976 wrote to memory of 5848 3976 D9CC.tmp 127 PID 5848 wrote to memory of 2040 5848 DA97.tmp 128 PID 2040 wrote to memory of 5236 2040 DB53.tmp 129 PID 5236 wrote to memory of 6128 5236 DBEF.tmp 130 PID 6128 wrote to memory of 4760 6128 DD37.tmp 131 PID 4760 wrote to memory of 2452 4760 DDF2.tmp 132 PID 2452 wrote to memory of 2436 2452 DEEC.tmp 133 PID 2436 wrote to memory of 5420 2436 DFC7.tmp 134 PID 5420 wrote to memory of 3432 5420 E083.tmp 135 PID 3432 wrote to memory of 1484 3432 E11F.tmp 136 PID 1484 wrote to memory of 5996 1484 E1AC.tmp 137 PID 5996 wrote to memory of 5276 5996 E248.tmp 138 PID 5276 wrote to memory of 6036 5276 E2C5.tmp 139 PID 6036 wrote to memory of 2324 6036 E371.tmp 140 PID 2324 wrote to memory of 2296 2324 E3FD.tmp 141 PID 2296 wrote to memory of 4448 2296 E49A.tmp 142 PID 4448 wrote to memory of 4124 4448 E517.tmp 143 PID 4124 wrote to memory of 4500 4124 E5A3.tmp 144 PID 4500 wrote to memory of 1748 4500 E63F.tmp 145 PID 1748 wrote to memory of 4900 1748 E6EB.tmp 146 PID 4900 wrote to memory of 4600 4900 E759.tmp 147 PID 4600 wrote to memory of 4016 4600 E7F5.tmp 148 PID 4016 wrote to memory of 2780 4016 E872.tmp 149 PID 2780 wrote to memory of 4736 2780 E8DF.tmp 150 PID 4736 wrote to memory of 1472 4736 E95C.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\B52D.tmp"C:\Users\Admin\AppData\Local\Temp\B52D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\B7EC.tmp"C:\Users\Admin\AppData\Local\Temp\B7EC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\BABB.tmp"C:\Users\Admin\AppData\Local\Temp\BABB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\BCED.tmp"C:\Users\Admin\AppData\Local\Temp\BCED.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\C114.tmp"C:\Users\Admin\AppData\Local\Temp\C114.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\C23D.tmp"C:\Users\Admin\AppData\Local\Temp\C23D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\C394.tmp"C:\Users\Admin\AppData\Local\Temp\C394.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\C47F.tmp"C:\Users\Admin\AppData\Local\Temp\C47F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\C588.tmp"C:\Users\Admin\AppData\Local\Temp\C588.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\C673.tmp"C:\Users\Admin\AppData\Local\Temp\C673.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\C73E.tmp"C:\Users\Admin\AppData\Local\Temp\C73E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\C809.tmp"C:\Users\Admin\AppData\Local\Temp\C809.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\CB07.tmp"C:\Users\Admin\AppData\Local\Temp\CB07.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\CC01.tmp"C:\Users\Admin\AppData\Local\Temp\CC01.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\CE04.tmp"C:\Users\Admin\AppData\Local\Temp\CE04.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\D102.tmp"C:\Users\Admin\AppData\Local\Temp\D102.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\D23A.tmp"C:\Users\Admin\AppData\Local\Temp\D23A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\D315.tmp"C:\Users\Admin\AppData\Local\Temp\D315.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\D46D.tmp"C:\Users\Admin\AppData\Local\Temp\D46D.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\D661.tmp"C:\Users\Admin\AppData\Local\Temp\D661.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\D71C.tmp"C:\Users\Admin\AppData\Local\Temp\D71C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\DA97.tmp"C:\Users\Admin\AppData\Local\Temp\DA97.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\DB53.tmp"C:\Users\Admin\AppData\Local\Temp\DB53.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\DD37.tmp"C:\Users\Admin\AppData\Local\Temp\DD37.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\DEEC.tmp"C:\Users\Admin\AppData\Local\Temp\DEEC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\E083.tmp"C:\Users\Admin\AppData\Local\Temp\E083.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\E11F.tmp"C:\Users\Admin\AppData\Local\Temp\E11F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\E248.tmp"C:\Users\Admin\AppData\Local\Temp\E248.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\E2C5.tmp"C:\Users\Admin\AppData\Local\Temp\E2C5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\E371.tmp"C:\Users\Admin\AppData\Local\Temp\E371.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\E49A.tmp"C:\Users\Admin\AppData\Local\Temp\E49A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\E517.tmp"C:\Users\Admin\AppData\Local\Temp\E517.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\E63F.tmp"C:\Users\Admin\AppData\Local\Temp\E63F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\E759.tmp"C:\Users\Admin\AppData\Local\Temp\E759.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\E872.tmp"C:\Users\Admin\AppData\Local\Temp\E872.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\E8DF.tmp"C:\Users\Admin\AppData\Local\Temp\E8DF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\E95C.tmp"C:\Users\Admin\AppData\Local\Temp\E95C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\E9E9.tmp"C:\Users\Admin\AppData\Local\Temp\E9E9.tmp"65⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\EA56.tmp"C:\Users\Admin\AppData\Local\Temp\EA56.tmp"66⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"67⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"68⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\EC2B.tmp"C:\Users\Admin\AppData\Local\Temp\EC2B.tmp"69⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"70⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\ED06.tmp"C:\Users\Admin\AppData\Local\Temp\ED06.tmp"71⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\ED83.tmp"C:\Users\Admin\AppData\Local\Temp\ED83.tmp"72⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\EE00.tmp"C:\Users\Admin\AppData\Local\Temp\EE00.tmp"73⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\EE7D.tmp"C:\Users\Admin\AppData\Local\Temp\EE7D.tmp"74⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\EF29.tmp"C:\Users\Admin\AppData\Local\Temp\EF29.tmp"75⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\EF96.tmp"C:\Users\Admin\AppData\Local\Temp\EF96.tmp"76⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\F042.tmp"C:\Users\Admin\AppData\Local\Temp\F042.tmp"77⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"78⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\F15B.tmp"C:\Users\Admin\AppData\Local\Temp\F15B.tmp"79⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"80⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\F246.tmp"C:\Users\Admin\AppData\Local\Temp\F246.tmp"81⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"82⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\F35F.tmp"C:\Users\Admin\AppData\Local\Temp\F35F.tmp"83⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\F3DC.tmp"C:\Users\Admin\AppData\Local\Temp\F3DC.tmp"84⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\F459.tmp"C:\Users\Admin\AppData\Local\Temp\F459.tmp"85⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"86⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\F543.tmp"C:\Users\Admin\AppData\Local\Temp\F543.tmp"87⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"88⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\F62E.tmp"C:\Users\Admin\AppData\Local\Temp\F62E.tmp"89⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"90⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\F737.tmp"C:\Users\Admin\AppData\Local\Temp\F737.tmp"91⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"92⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\F850.tmp"C:\Users\Admin\AppData\Local\Temp\F850.tmp"93⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"94⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\F94A.tmp"C:\Users\Admin\AppData\Local\Temp\F94A.tmp"95⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"96⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\FA54.tmp"C:\Users\Admin\AppData\Local\Temp\FA54.tmp"97⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\FAE1.tmp"C:\Users\Admin\AppData\Local\Temp\FAE1.tmp"98⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"99⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"100⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\FC67.tmp"C:\Users\Admin\AppData\Local\Temp\FC67.tmp"101⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"102⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\FD61.tmp"C:\Users\Admin\AppData\Local\Temp\FD61.tmp"103⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"104⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"105⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"106⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\FF75.tmp"C:\Users\Admin\AppData\Local\Temp\FF75.tmp"107⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"108⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\6F.tmp"C:\Users\Admin\AppData\Local\Temp\6F.tmp"109⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\EC.tmp"C:\Users\Admin\AppData\Local\Temp\EC.tmp"110⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\169.tmp"C:\Users\Admin\AppData\Local\Temp\169.tmp"111⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\1F5.tmp"C:\Users\Admin\AppData\Local\Temp\1F5.tmp"112⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\263.tmp"C:\Users\Admin\AppData\Local\Temp\263.tmp"113⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\2D0.tmp"C:\Users\Admin\AppData\Local\Temp\2D0.tmp"114⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\35D.tmp"C:\Users\Admin\AppData\Local\Temp\35D.tmp"115⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\3E9.tmp"C:\Users\Admin\AppData\Local\Temp\3E9.tmp"116⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\466.tmp"C:\Users\Admin\AppData\Local\Temp\466.tmp"117⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\4F3.tmp"C:\Users\Admin\AppData\Local\Temp\4F3.tmp"118⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\57F.tmp"C:\Users\Admin\AppData\Local\Temp\57F.tmp"119⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\60C.tmp"C:\Users\Admin\AppData\Local\Temp\60C.tmp"120⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\699.tmp"C:\Users\Admin\AppData\Local\Temp\699.tmp"121⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\716.tmp"C:\Users\Admin\AppData\Local\Temp\716.tmp"122⤵PID:3040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-