Analysis
- max time kernel
118s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 05:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_833ff9f5ab2a04c384e9e31ad0a149cd_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_833ff9f5ab2a04c384e9e31ad0a149cd_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_833ff9f5ab2a04c384e9e31ad0a149cd_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260802-gnyclaea36
- SHA256 ddc8f37bcb70e04e5e7b998812527037a54b870a777c9be3b32e5551f9846f86
- MD5 833ff9f5ab2a04c384e9e31ad0a149cd
- SHA1 ebf1e74597476830a1c2bd67a4c03f28eb656f4a
- SHA512 1a62b17680fcca7ba1605a912ad537dc0ede160ae8e2781abb0ffbad4f78f96ecc94c75625ad18b4781cf2a345e5d06c79e8b4de74154e8bd8abd02de31f7d82
- SSDEEP 12288:9U5rCOTei6qVaZzORrbW5wwUKaPdv4yJOMjqZoXWjdq:9UQOJ6qVUORrbsww3aP94yJNqqGh
- TLSH T135C4F1227945C032E5A202314EE6EB71687ABC355B26A4C73BC0777E6EB52E1D339317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3364 E611.tmp 3284 E69D.tmp 5300 E70B.tmp 3684 E778.tmp 3500 E7E5.tmp 3396 E853.tmp 4012 EA56.tmp 5660 EB50.tmp 4116 EC1B.tmp 4564 ECE7.tmp 124 ED64.tmp 1532 EE1F.tmp 3512 EEFA.tmp 6048 EFD5.tmp 3044 F071.tmp 5100 F10D.tmp 5468 F1C9.tmp 5096 F265.tmp 2524 F330.tmp 2092 F3CC.tmp 1144 F488.tmp 6056 F572.tmp 1592 F67C.tmp 3080 F708.tmp 3320 F7D3.tmp 2836 F88F.tmp 2388 F91C.tmp 4976 F999.tmp 5700 FA16.tmp 1188 FB00.tmp 2932 FBCB.tmp 3132 FC77.tmp 5340 FD04.tmp 3008 FD81.tmp 4168 FE0D.tmp 5040 FE8A.tmp 5572 FF17.tmp 3544 FFD2.tmp 3252 4F.tmp 3568 CC.tmp 2068 178.tmp 2428 214.tmp 5372 282.tmp 6088 33D.tmp 5852 3CA.tmp 1816 495.tmp 5896 560.tmp 4916 5DD.tmp 4856 66A.tmp 4820 706.tmp 2964 7B2.tmp 3868 88D.tmp 3880 919.tmp 3700 9E4.tmp 5596 A90.tmp 4868 B7B.tmp 4164 C27.tmp 1176 CC3.tmp 1104 D40.tmp 4224 E0B.tmp 2292 E98.tmp 4892 F53.tmp 3408 100F.tmp 4188 108C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C852.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 903B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A16D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 493A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 995E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 347A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9595.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 294F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 596C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 945D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 774F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 350B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 446D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADB1.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 3364 1780 2026-08-02_833ff9f5ab2a04c384e9e31ad0a149cd_elex_mafia_stealc_tofsee.exe 88 PID 3364 wrote to memory of 3284 3364 E611.tmp 89 PID 3284 wrote to memory of 5300 3284 E69D.tmp 90 PID 5300 wrote to memory of 3684 5300 E70B.tmp 91 PID 3684 wrote to memory of 3500 3684 E778.tmp 92 PID 3500 wrote to memory of 3396 3500 E7E5.tmp 93 PID 3396 wrote to memory of 4012 3396 E853.tmp 94 PID 4012 wrote to memory of 5660 4012 EA56.tmp 95 PID 5660 wrote to memory of 4116 5660 EB50.tmp 96 PID 4116 wrote to memory of 4564 4116 EC1B.tmp 97 PID 4564 wrote to memory of 124 4564 ECE7.tmp 98 PID 124 wrote to memory of 1532 124 ED64.tmp 99 PID 1532 wrote to memory of 3512 1532 EE1F.tmp 100 PID 3512 wrote to memory of 6048 3512 EEFA.tmp 101 PID 6048 wrote to memory of 3044 6048 EFD5.tmp 102 PID 3044 wrote to memory of 5100 3044 F071.tmp 103 PID 5100 wrote to memory of 5468 5100 F10D.tmp 104 PID 5468 wrote to memory of 5096 5468 F1C9.tmp 105 PID 5096 wrote to memory of 2524 5096 F265.tmp 106 PID 2524 wrote to memory of 2092 2524 F330.tmp 107 PID 2092 wrote to memory of 1144 2092 F3CC.tmp 108 PID 1144 wrote to memory of 6056 1144 F488.tmp 109 PID 6056 wrote to memory of 1592 6056 F572.tmp 110 PID 1592 wrote to memory of 3080 1592 F67C.tmp 111 PID 3080 wrote to memory of 3320 3080 F708.tmp 112 PID 3320 wrote to memory of 2836 3320 F7D3.tmp 113 PID 2836 wrote to memory of 2388 2836 F88F.tmp 114 PID 2388 wrote to memory of 4976 2388 F91C.tmp 115 PID 4976 wrote to memory of 5700 4976 F999.tmp 116 PID 5700 wrote to memory of 1188 5700 FA16.tmp 117 PID 1188 wrote to memory of 2932 1188 FB00.tmp 118 PID 2932 wrote to memory of 3132 2932 FBCB.tmp 119 PID 3132 wrote to memory of 5340 3132 FC77.tmp 120 PID 5340 wrote to memory of 3008 5340 FD04.tmp 121 PID 3008 wrote to memory of 4168 3008 FD81.tmp 122 PID 4168 wrote to memory of 5040 4168 FE0D.tmp 123 PID 5040 wrote to memory of 5572 5040 FE8A.tmp 124 PID 5572 wrote to memory of 3544 5572 FF17.tmp 125 PID 3544 wrote to memory of 3252 3544 FFD2.tmp 126 PID 3252 wrote to memory of 3568 3252 4F.tmp 127 PID 3568 wrote to memory of 2068 3568 CC.tmp 128 PID 2068 wrote to memory of 2428 2068 178.tmp 129 PID 2428 wrote to memory of 5372 2428 214.tmp 130 PID 5372 wrote to memory of 6088 5372 282.tmp 131 PID 6088 wrote to memory of 5852 6088 33D.tmp 132 PID 5852 wrote to memory of 1816 5852 3CA.tmp 133 PID 1816 wrote to memory of 5896 1816 495.tmp 134 PID 5896 wrote to memory of 4916 5896 560.tmp 135 PID 4916 wrote to memory of 4856 4916 5DD.tmp 136 PID 4856 wrote to memory of 4820 4856 66A.tmp 137 PID 4820 wrote to memory of 2964 4820 706.tmp 138 PID 2964 wrote to memory of 3868 2964 7B2.tmp 139 PID 3868 wrote to memory of 3880 3868 88D.tmp 140 PID 3880 wrote to memory of 3700 3880 919.tmp 141 PID 3700 wrote to memory of 5596 3700 9E4.tmp 142 PID 5596 wrote to memory of 4868 5596 A90.tmp 143 PID 4868 wrote to memory of 4164 4868 B7B.tmp 144 PID 4164 wrote to memory of 1176 4164 C27.tmp 145 PID 1176 wrote to memory of 1104 1176 CC3.tmp 146 PID 1104 wrote to memory of 4224 1104 D40.tmp 147 PID 4224 wrote to memory of 2292 4224 E0B.tmp 148 PID 2292 wrote to memory of 4892 2292 E98.tmp 149 PID 4892 wrote to memory of 3408 4892 F53.tmp 150 PID 3408 wrote to memory of 4188 3408 100F.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_833ff9f5ab2a04c384e9e31ad0a149cd_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_833ff9f5ab2a04c384e9e31ad0a149cd_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\E611.tmp"C:\Users\Admin\AppData\Local\Temp\E611.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\E69D.tmp"C:\Users\Admin\AppData\Local\Temp\E69D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\E70B.tmp"C:\Users\Admin\AppData\Local\Temp\E70B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\E778.tmp"C:\Users\Admin\AppData\Local\Temp\E778.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\E853.tmp"C:\Users\Admin\AppData\Local\Temp\E853.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\EA56.tmp"C:\Users\Admin\AppData\Local\Temp\EA56.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\EB50.tmp"C:\Users\Admin\AppData\Local\Temp\EB50.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\ED64.tmp"C:\Users\Admin\AppData\Local\Temp\ED64.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\F071.tmp"C:\Users\Admin\AppData\Local\Temp\F071.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\F10D.tmp"C:\Users\Admin\AppData\Local\Temp\F10D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\F1C9.tmp"C:\Users\Admin\AppData\Local\Temp\F1C9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\F265.tmp"C:\Users\Admin\AppData\Local\Temp\F265.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\F330.tmp"C:\Users\Admin\AppData\Local\Temp\F330.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\F488.tmp"C:\Users\Admin\AppData\Local\Temp\F488.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\F67C.tmp"C:\Users\Admin\AppData\Local\Temp\F67C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\F708.tmp"C:\Users\Admin\AppData\Local\Temp\F708.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\F7D3.tmp"C:\Users\Admin\AppData\Local\Temp\F7D3.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\F88F.tmp"C:\Users\Admin\AppData\Local\Temp\F88F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\F91C.tmp"C:\Users\Admin\AppData\Local\Temp\F91C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\F999.tmp"C:\Users\Admin\AppData\Local\Temp\F999.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\FA16.tmp"C:\Users\Admin\AppData\Local\Temp\FA16.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\FB00.tmp"C:\Users\Admin\AppData\Local\Temp\FB00.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\FC77.tmp"C:\Users\Admin\AppData\Local\Temp\FC77.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\FD81.tmp"C:\Users\Admin\AppData\Local\Temp\FD81.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\178.tmp"C:\Users\Admin\AppData\Local\Temp\178.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\214.tmp"C:\Users\Admin\AppData\Local\Temp\214.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\282.tmp"C:\Users\Admin\AppData\Local\Temp\282.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\33D.tmp"C:\Users\Admin\AppData\Local\Temp\33D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\3CA.tmp"C:\Users\Admin\AppData\Local\Temp\3CA.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\495.tmp"C:\Users\Admin\AppData\Local\Temp\495.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\560.tmp"C:\Users\Admin\AppData\Local\Temp\560.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\5DD.tmp"C:\Users\Admin\AppData\Local\Temp\5DD.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\66A.tmp"C:\Users\Admin\AppData\Local\Temp\66A.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\706.tmp"C:\Users\Admin\AppData\Local\Temp\706.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\7B2.tmp"C:\Users\Admin\AppData\Local\Temp\7B2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\919.tmp"C:\Users\Admin\AppData\Local\Temp\919.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\9E4.tmp"C:\Users\Admin\AppData\Local\Temp\9E4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\A90.tmp"C:\Users\Admin\AppData\Local\Temp\A90.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\B7B.tmp"C:\Users\Admin\AppData\Local\Temp\B7B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\C27.tmp"C:\Users\Admin\AppData\Local\Temp\C27.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\CC3.tmp"C:\Users\Admin\AppData\Local\Temp\CC3.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\D40.tmp"C:\Users\Admin\AppData\Local\Temp\D40.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\E0B.tmp"C:\Users\Admin\AppData\Local\Temp\E0B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\F53.tmp"C:\Users\Admin\AppData\Local\Temp\F53.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\100F.tmp"C:\Users\Admin\AppData\Local\Temp\100F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\108C.tmp"C:\Users\Admin\AppData\Local\Temp\108C.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\1147.tmp"C:\Users\Admin\AppData\Local\Temp\1147.tmp"66⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\1203.tmp"C:\Users\Admin\AppData\Local\Temp\1203.tmp"67⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\12DD.tmp"C:\Users\Admin\AppData\Local\Temp\12DD.tmp"68⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\13A8.tmp"C:\Users\Admin\AppData\Local\Temp\13A8.tmp"69⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\1445.tmp"C:\Users\Admin\AppData\Local\Temp\1445.tmp"70⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\14D1.tmp"C:\Users\Admin\AppData\Local\Temp\14D1.tmp"71⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\157D.tmp"C:\Users\Admin\AppData\Local\Temp\157D.tmp"72⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\160A.tmp"C:\Users\Admin\AppData\Local\Temp\160A.tmp"73⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\1696.tmp"C:\Users\Admin\AppData\Local\Temp\1696.tmp"74⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\1713.tmp"C:\Users\Admin\AppData\Local\Temp\1713.tmp"75⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\17A0.tmp"C:\Users\Admin\AppData\Local\Temp\17A0.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\181D.tmp"C:\Users\Admin\AppData\Local\Temp\181D.tmp"77⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\18C9.tmp"C:\Users\Admin\AppData\Local\Temp\18C9.tmp"78⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\1975.tmp"C:\Users\Admin\AppData\Local\Temp\1975.tmp"79⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\1A30.tmp"C:\Users\Admin\AppData\Local\Temp\1A30.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"81⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\1B59.tmp"C:\Users\Admin\AppData\Local\Temp\1B59.tmp"82⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"84⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"85⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"86⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\1E66.tmp"C:\Users\Admin\AppData\Local\Temp\1E66.tmp"87⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"88⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\1F41.tmp"C:\Users\Admin\AppData\Local\Temp\1F41.tmp"89⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"90⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\204B.tmp"C:\Users\Admin\AppData\Local\Temp\204B.tmp"91⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\20E7.tmp"C:\Users\Admin\AppData\Local\Temp\20E7.tmp"92⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\2154.tmp"C:\Users\Admin\AppData\Local\Temp\2154.tmp"93⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\21F1.tmp"C:\Users\Admin\AppData\Local\Temp\21F1.tmp"94⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\226E.tmp"C:\Users\Admin\AppData\Local\Temp\226E.tmp"95⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\230A.tmp"C:\Users\Admin\AppData\Local\Temp\230A.tmp"96⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\2377.tmp"C:\Users\Admin\AppData\Local\Temp\2377.tmp"97⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"98⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2471.tmp"C:\Users\Admin\AppData\Local\Temp\2471.tmp"99⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"100⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"101⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\25D9.tmp"C:\Users\Admin\AppData\Local\Temp\25D9.tmp"102⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\2656.tmp"C:\Users\Admin\AppData\Local\Temp\2656.tmp"103⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\26D3.tmp"C:\Users\Admin\AppData\Local\Temp\26D3.tmp"104⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\2750.tmp"C:\Users\Admin\AppData\Local\Temp\2750.tmp"105⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\27EC.tmp"C:\Users\Admin\AppData\Local\Temp\27EC.tmp"106⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2879.tmp"C:\Users\Admin\AppData\Local\Temp\2879.tmp"107⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\28F6.tmp"C:\Users\Admin\AppData\Local\Temp\28F6.tmp"108⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\2982.tmp"C:\Users\Admin\AppData\Local\Temp\2982.tmp"109⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\29FF.tmp"C:\Users\Admin\AppData\Local\Temp\29FF.tmp"110⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"111⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\2B38.tmp"C:\Users\Admin\AppData\Local\Temp\2B38.tmp"112⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"113⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2C32.tmp"C:\Users\Admin\AppData\Local\Temp\2C32.tmp"114⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\2C9F.tmp"C:\Users\Admin\AppData\Local\Temp\2C9F.tmp"115⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\2D3B.tmp"C:\Users\Admin\AppData\Local\Temp\2D3B.tmp"116⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\2DA9.tmp"C:\Users\Admin\AppData\Local\Temp\2DA9.tmp"117⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\2E26.tmp"C:\Users\Admin\AppData\Local\Temp\2E26.tmp"118⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2E93.tmp"C:\Users\Admin\AppData\Local\Temp\2E93.tmp"119⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\2F00.tmp"C:\Users\Admin\AppData\Local\Temp\2F00.tmp"120⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2F5E.tmp"C:\Users\Admin\AppData\Local\Temp\2F5E.tmp"121⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\2FCC.tmp"C:\Users\Admin\AppData\Local\Temp\2FCC.tmp"122⤵PID:1484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-