Analysis
- max time kernel
127s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 07:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_35132f0ac4eceea9ad4c7d4e3f32b3a4_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_35132f0ac4eceea9ad4c7d4e3f32b3a4_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-04_35132f0ac4eceea9ad4c7d4e3f32b3a4_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260804-jla6dsvakb
- SHA256 bf895f6821811530c8f88eefdea674d63894fb736b513a2554c070ff375930e2
- MD5 35132f0ac4eceea9ad4c7d4e3f32b3a4
- SHA1 3b43bd52b235b2f48d80de3bfbc27016453bd09e
- SHA512 13412921de1de1c8cdeb33e6825a897d4743e7c121fb6cd1291bfa18db76d69f86351565382b4982d908743ce110bcfaa6d0140b327192c0cc282e5f5127f35b
- SSDEEP 12288:9U5rCOTei61T33M+NQvu8vV8QKvrKnPUCvZ5qZoXWjdqpby1grA70G+o:9UQOJ61TuvdV8fOnPt5qqGh4yATXo
- TLSH T176E401217985C132E99612304EF5EBB1297ABC759B3264C777C0667E6FB02E1E238347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5496 8FB3.tmp 2988 908E.tmp 5884 91A7.tmp 4544 9272.tmp 2872 936C.tmp 4316 9437.tmp 3096 9512.tmp 1992 95CE.tmp 5400 96C8.tmp 4444 9793.tmp 5012 986E.tmp 3904 9929.tmp 4780 99E5.tmp 3588 9A90.tmp 5260 9B4C.tmp 620 9BE8.tmp 5792 9CE2.tmp 5532 9DAD.tmp 1032 9E78.tmp 4336 9F44.tmp 4604 A04D.tmp 5304 A109.tmp 4796 A203.tmp 3076 A2DD.tmp 924 A399.tmp 4408 A4A3.tmp 3724 A55E.tmp 2568 A658.tmp 2420 A752.tmp 3204 A82D.tmp 3136 A8E8.tmp 1996 AA02.tmp 4760 AADC.tmp 4988 ABA7.tmp 5044 AC34.tmp 4332 AD0F.tmp 6072 ADBB.tmp 3388 AE47.tmp 1184 AED4.tmp 2080 AF61.tmp 1356 AFFD.tmp 2192 B0A9.tmp 1196 B135.tmp 2808 B1D2.tmp 592 B28D.tmp 2632 B339.tmp 5960 B3E5.tmp 5776 B462.tmp 3144 B4CF.tmp 5392 B55C.tmp 2676 B5D9.tmp 3324 B665.tmp 1444 B702.tmp 2628 B78E.tmp 1324 B83A.tmp 1784 B8C7.tmp 2992 B963.tmp 5904 B9D0.tmp 2496 BA6D.tmp 2152 BADA.tmp 4628 BBD4.tmp 1928 BC70.tmp 4288 BCFD.tmp 364 BD8A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 936C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4727.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1384.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7636.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 367E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 410D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B28D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D40A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E38B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1260.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D66C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABA.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4660 wrote to memory of 5496 4660 2026-08-04_35132f0ac4eceea9ad4c7d4e3f32b3a4_elex_mafia_stealc_tofsee.exe 90 PID 5496 wrote to memory of 2988 5496 8FB3.tmp 91 PID 2988 wrote to memory of 5884 2988 908E.tmp 92 PID 5884 wrote to memory of 4544 5884 91A7.tmp 93 PID 4544 wrote to memory of 2872 4544 9272.tmp 94 PID 2872 wrote to memory of 4316 2872 936C.tmp 95 PID 4316 wrote to memory of 3096 4316 9437.tmp 96 PID 3096 wrote to memory of 1992 3096 9512.tmp 97 PID 1992 wrote to memory of 5400 1992 95CE.tmp 98 PID 5400 wrote to memory of 4444 5400 96C8.tmp 99 PID 4444 wrote to memory of 5012 4444 9793.tmp 100 PID 5012 wrote to memory of 3904 5012 986E.tmp 101 PID 3904 wrote to memory of 4780 3904 9929.tmp 102 PID 4780 wrote to memory of 3588 4780 99E5.tmp 103 PID 3588 wrote to memory of 5260 3588 9A90.tmp 104 PID 5260 wrote to memory of 620 5260 9B4C.tmp 105 PID 620 wrote to memory of 5792 620 9BE8.tmp 106 PID 5792 wrote to memory of 5532 5792 9CE2.tmp 107 PID 5532 wrote to memory of 1032 5532 9DAD.tmp 108 PID 1032 wrote to memory of 4336 1032 9E78.tmp 109 PID 4336 wrote to memory of 4604 4336 9F44.tmp 110 PID 4604 wrote to memory of 5304 4604 A04D.tmp 111 PID 5304 wrote to memory of 4796 5304 A109.tmp 112 PID 4796 wrote to memory of 3076 4796 A203.tmp 113 PID 3076 wrote to memory of 924 3076 A2DD.tmp 114 PID 924 wrote to memory of 4408 924 A399.tmp 115 PID 4408 wrote to memory of 3724 4408 A4A3.tmp 116 PID 3724 wrote to memory of 2568 3724 A55E.tmp 117 PID 2568 wrote to memory of 2420 2568 A658.tmp 118 PID 2420 wrote to memory of 3204 2420 A752.tmp 119 PID 3204 wrote to memory of 3136 3204 A82D.tmp 120 PID 3136 wrote to memory of 1996 3136 A8E8.tmp 121 PID 1996 wrote to memory of 4760 1996 AA02.tmp 122 PID 4760 wrote to memory of 4988 4760 AADC.tmp 123 PID 4988 wrote to memory of 5044 4988 ABA7.tmp 124 PID 5044 wrote to memory of 4332 5044 AC34.tmp 125 PID 4332 wrote to memory of 6072 4332 AD0F.tmp 126 PID 6072 wrote to memory of 3388 6072 ADBB.tmp 127 PID 3388 wrote to memory of 1184 3388 AE47.tmp 128 PID 1184 wrote to memory of 2080 1184 AED4.tmp 129 PID 2080 wrote to memory of 1356 2080 AF61.tmp 130 PID 1356 wrote to memory of 2192 1356 AFFD.tmp 131 PID 2192 wrote to memory of 1196 2192 B0A9.tmp 132 PID 1196 wrote to memory of 2808 1196 B135.tmp 133 PID 2808 wrote to memory of 592 2808 B1D2.tmp 134 PID 592 wrote to memory of 2632 592 B28D.tmp 135 PID 2632 wrote to memory of 5960 2632 B339.tmp 136 PID 5960 wrote to memory of 5776 5960 B3E5.tmp 137 PID 5776 wrote to memory of 3144 5776 B462.tmp 138 PID 3144 wrote to memory of 5392 3144 B4CF.tmp 139 PID 5392 wrote to memory of 2676 5392 B55C.tmp 140 PID 2676 wrote to memory of 3324 2676 B5D9.tmp 141 PID 3324 wrote to memory of 1444 3324 B665.tmp 142 PID 1444 wrote to memory of 2628 1444 B702.tmp 143 PID 2628 wrote to memory of 1324 2628 B78E.tmp 144 PID 1324 wrote to memory of 1784 1324 B83A.tmp 145 PID 1784 wrote to memory of 2992 1784 B8C7.tmp 146 PID 2992 wrote to memory of 5904 2992 B963.tmp 147 PID 5904 wrote to memory of 2496 5904 B9D0.tmp 148 PID 2496 wrote to memory of 2152 2496 BA6D.tmp 149 PID 3880 wrote to memory of 4628 3880 BB76.tmp 151 PID 4628 wrote to memory of 1928 4628 BBD4.tmp 152 PID 1928 wrote to memory of 4288 1928 BC70.tmp 153 PID 4288 wrote to memory of 364 4288 BCFD.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_35132f0ac4eceea9ad4c7d4e3f32b3a4_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_35132f0ac4eceea9ad4c7d4e3f32b3a4_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\908E.tmp"C:\Users\Admin\AppData\Local\Temp\908E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\91A7.tmp"C:\Users\Admin\AppData\Local\Temp\91A7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\9272.tmp"C:\Users\Admin\AppData\Local\Temp\9272.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\936C.tmp"C:\Users\Admin\AppData\Local\Temp\936C.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\9512.tmp"C:\Users\Admin\AppData\Local\Temp\9512.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\95CE.tmp"C:\Users\Admin\AppData\Local\Temp\95CE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\96C8.tmp"C:\Users\Admin\AppData\Local\Temp\96C8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\986E.tmp"C:\Users\Admin\AppData\Local\Temp\986E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\99E5.tmp"C:\Users\Admin\AppData\Local\Temp\99E5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\9A90.tmp"C:\Users\Admin\AppData\Local\Temp\9A90.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\9E78.tmp"C:\Users\Admin\AppData\Local\Temp\9E78.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\9F44.tmp"C:\Users\Admin\AppData\Local\Temp\9F44.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\A04D.tmp"C:\Users\Admin\AppData\Local\Temp\A04D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\A109.tmp"C:\Users\Admin\AppData\Local\Temp\A109.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\A203.tmp"C:\Users\Admin\AppData\Local\Temp\A203.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\A399.tmp"C:\Users\Admin\AppData\Local\Temp\A399.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\A4A3.tmp"C:\Users\Admin\AppData\Local\Temp\A4A3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\A55E.tmp"C:\Users\Admin\AppData\Local\Temp\A55E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\A658.tmp"C:\Users\Admin\AppData\Local\Temp\A658.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\A752.tmp"C:\Users\Admin\AppData\Local\Temp\A752.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\A82D.tmp"C:\Users\Admin\AppData\Local\Temp\A82D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\AA02.tmp"C:\Users\Admin\AppData\Local\Temp\AA02.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\AADC.tmp"C:\Users\Admin\AppData\Local\Temp\AADC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\AC34.tmp"C:\Users\Admin\AppData\Local\Temp\AC34.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\AE47.tmp"C:\Users\Admin\AppData\Local\Temp\AE47.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\AED4.tmp"C:\Users\Admin\AppData\Local\Temp\AED4.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\AF61.tmp"C:\Users\Admin\AppData\Local\Temp\AF61.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\B135.tmp"C:\Users\Admin\AppData\Local\Temp\B135.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\B462.tmp"C:\Users\Admin\AppData\Local\Temp\B462.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\B55C.tmp"C:\Users\Admin\AppData\Local\Temp\B55C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\B665.tmp"C:\Users\Admin\AppData\Local\Temp\B665.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\B702.tmp"C:\Users\Admin\AppData\Local\Temp\B702.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\B78E.tmp"C:\Users\Admin\AppData\Local\Temp\B78E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\B83A.tmp"C:\Users\Admin\AppData\Local\Temp\B83A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\B963.tmp"C:\Users\Admin\AppData\Local\Temp\B963.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\BA6D.tmp"C:\Users\Admin\AppData\Local\Temp\BA6D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\BADA.tmp"C:\Users\Admin\AppData\Local\Temp\BADA.tmp"61⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\BB76.tmp"C:\Users\Admin\AppData\Local\Temp\BB76.tmp"62⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\BC70.tmp"C:\Users\Admin\AppData\Local\Temp\BC70.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\BCFD.tmp"C:\Users\Admin\AppData\Local\Temp\BCFD.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"66⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\BE07.tmp"C:\Users\Admin\AppData\Local\Temp\BE07.tmp"67⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"68⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"69⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"70⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\C087.tmp"C:\Users\Admin\AppData\Local\Temp\C087.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\C114.tmp"C:\Users\Admin\AppData\Local\Temp\C114.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"73⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"74⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"75⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\C346.tmp"C:\Users\Admin\AppData\Local\Temp\C346.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"77⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\C46F.tmp"C:\Users\Admin\AppData\Local\Temp\C46F.tmp"78⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\C50B.tmp"C:\Users\Admin\AppData\Local\Temp\C50B.tmp"79⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\C579.tmp"C:\Users\Admin\AppData\Local\Temp\C579.tmp"80⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"81⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\C6A2.tmp"C:\Users\Admin\AppData\Local\Temp\C6A2.tmp"82⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\C73E.tmp"C:\Users\Admin\AppData\Local\Temp\C73E.tmp"83⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\C7CB.tmp"C:\Users\Admin\AppData\Local\Temp\C7CB.tmp"84⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\C867.tmp"C:\Users\Admin\AppData\Local\Temp\C867.tmp"85⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\C903.tmp"C:\Users\Admin\AppData\Local\Temp\C903.tmp"86⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\C990.tmp"C:\Users\Admin\AppData\Local\Temp\C990.tmp"87⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"88⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"89⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\CB84.tmp"C:\Users\Admin\AppData\Local\Temp\CB84.tmp"90⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\CC01.tmp"C:\Users\Admin\AppData\Local\Temp\CC01.tmp"91⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"92⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\CD2A.tmp"C:\Users\Admin\AppData\Local\Temp\CD2A.tmp"93⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:996 -
C:\Users\Admin\AppData\Local\Temp\CE72.tmp"C:\Users\Admin\AppData\Local\Temp\CE72.tmp"95⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\CF0E.tmp"C:\Users\Admin\AppData\Local\Temp\CF0E.tmp"96⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\D075.tmp"C:\Users\Admin\AppData\Local\Temp\D075.tmp"98⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\D112.tmp"C:\Users\Admin\AppData\Local\Temp\D112.tmp"99⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\D19E.tmp"C:\Users\Admin\AppData\Local\Temp\D19E.tmp"100⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\D22B.tmp"C:\Users\Admin\AppData\Local\Temp\D22B.tmp"101⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"102⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\D363.tmp"C:\Users\Admin\AppData\Local\Temp\D363.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\D40F.tmp"C:\Users\Admin\AppData\Local\Temp\D40F.tmp"104⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\D49C.tmp"C:\Users\Admin\AppData\Local\Temp\D49C.tmp"105⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"106⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"107⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\D690.tmp"C:\Users\Admin\AppData\Local\Temp\D690.tmp"108⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\D72C.tmp"C:\Users\Admin\AppData\Local\Temp\D72C.tmp"109⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\D799.tmp"C:\Users\Admin\AppData\Local\Temp\D799.tmp"110⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"111⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"112⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\D930.tmp"C:\Users\Admin\AppData\Local\Temp\D930.tmp"113⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"114⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"115⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"116⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\DB43.tmp"C:\Users\Admin\AppData\Local\Temp\DB43.tmp"117⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"118⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"119⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\DCF8.tmp"C:\Users\Admin\AppData\Local\Temp\DCF8.tmp"120⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"121⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"122⤵PID:5244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-