Analysis
- max time kernel
118s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 00:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_71e951a873137385b9068414e8855d25_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_71e951a873137385b9068414e8855d25_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_71e951a873137385b9068414e8855d25_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260805-a4k9msvbrc
- SHA256 06fda9346d7a54e51e19509f0d3cf29fe49bcc1b7bf560fe7e162b079606fbc7
- MD5 71e951a873137385b9068414e8855d25
- SHA1 773809e13abd4d856fef2f829019b049add35ce3
- SHA512 7ad7e60b60caa436e60311e7eaa6b0b50cb40fe0474414bb29a4e5d74b9ed7477964d5525fa85bb6ec3c2f696f01f426ec499eac299d23192f1ddbc803f5a2c5
- SSDEEP 12288:wU5rCOTeiD8K+Y9BGK6nEk5R5mtK0pmh0EEd40GFNZ+3/v+I9hUG2VA:wUQOJD8K+oAEesq0EEdQNGEA
- TLSH T16FE4D02073D88532E5FB037859B5E6604D7EFD22A722D6DF2F8016AE0971BD09A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2848 A762.tmp 5552 A8E8.tmp 5972 AAEC.tmp 2556 ABA7.tmp 4372 AC82.tmp 4928 AE09.tmp 1096 AF32.tmp 4576 B03B.tmp 1200 B126.tmp 2784 B23F.tmp 548 B339.tmp 5792 B471.tmp 4932 B55C.tmp 972 B6B4.tmp 5832 B7DC.tmp 1776 B9A2.tmp 4700 BB67.tmp 2484 BCBE.tmp 4692 BE35.tmp 900 BF6E.tmp 3148 C0D5.tmp 5752 C25C.tmp 5984 C394.tmp 3492 C4CD.tmp 6036 C605.tmp 5056 C77C.tmp 3396 C8B5.tmp 5564 C9AF.tmp 464 CAC8.tmp 4832 CC10.tmp 4420 CD1A.tmp 2528 CE33.tmp 5808 CF4C.tmp 5540 CFF8.tmp 2280 D0C3.tmp 5920 D1EC.tmp 1696 D2D7.tmp 1496 D383.tmp 4488 D46D.tmp 5136 D538.tmp 3404 D613.tmp 2404 D69F.tmp 4732 D78A.tmp 2508 D8A3.tmp 4192 D9AD.tmp 1652 DA97.tmp 3376 DB62.tmp 5408 DC5C.tmp 924 DD18.tmp 5116 DDB4.tmp 3468 DE31.tmp 4764 DECD.tmp 3340 DF4A.tmp 3704 DFE6.tmp 5460 E092.tmp 240 E11F.tmp 4236 E1AC.tmp 3976 E248.tmp 5500 E2E4.tmp 2476 E371.tmp 6120 E3EE.tmp 5512 E49A.tmp 1104 E507.tmp 5216 E5A3.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3440.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 448C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 730A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F66C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D756.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C25C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E37C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F11D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C40D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F185.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D63D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF53.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4848 wrote to memory of 2848 4848 2026-08-04_71e951a873137385b9068414e8855d25_elex_mafia_stealc_tofsee.exe 89 PID 2848 wrote to memory of 5552 2848 A762.tmp 90 PID 5552 wrote to memory of 5972 5552 A8E8.tmp 91 PID 5972 wrote to memory of 2556 5972 AAEC.tmp 92 PID 2556 wrote to memory of 4372 2556 ABA7.tmp 93 PID 4372 wrote to memory of 4928 4372 AC82.tmp 94 PID 4928 wrote to memory of 1096 4928 AE09.tmp 95 PID 1096 wrote to memory of 4576 1096 AF32.tmp 96 PID 4576 wrote to memory of 1200 4576 B03B.tmp 97 PID 1200 wrote to memory of 2784 1200 B126.tmp 98 PID 2784 wrote to memory of 548 2784 B23F.tmp 99 PID 548 wrote to memory of 5792 548 B339.tmp 100 PID 5792 wrote to memory of 4932 5792 B471.tmp 101 PID 4932 wrote to memory of 972 4932 B55C.tmp 102 PID 972 wrote to memory of 5832 972 B6B4.tmp 103 PID 5832 wrote to memory of 1776 5832 B7DC.tmp 104 PID 1776 wrote to memory of 4700 1776 B9A2.tmp 105 PID 4700 wrote to memory of 2484 4700 BB67.tmp 106 PID 2484 wrote to memory of 4692 2484 BCBE.tmp 107 PID 4692 wrote to memory of 900 4692 BE35.tmp 108 PID 900 wrote to memory of 3148 900 BF6E.tmp 109 PID 3148 wrote to memory of 5752 3148 C0D5.tmp 110 PID 5752 wrote to memory of 5984 5752 C25C.tmp 111 PID 5984 wrote to memory of 3492 5984 C394.tmp 112 PID 3492 wrote to memory of 6036 3492 C4CD.tmp 113 PID 6036 wrote to memory of 5056 6036 C605.tmp 114 PID 5056 wrote to memory of 3396 5056 C77C.tmp 115 PID 3396 wrote to memory of 5564 3396 C8B5.tmp 116 PID 5564 wrote to memory of 464 5564 C9AF.tmp 117 PID 464 wrote to memory of 4832 464 CAC8.tmp 118 PID 4832 wrote to memory of 4420 4832 CC10.tmp 119 PID 4420 wrote to memory of 2528 4420 CD1A.tmp 120 PID 2528 wrote to memory of 5808 2528 CE33.tmp 121 PID 5808 wrote to memory of 5540 5808 CF4C.tmp 122 PID 5540 wrote to memory of 2280 5540 CFF8.tmp 123 PID 2280 wrote to memory of 5920 2280 D0C3.tmp 124 PID 5920 wrote to memory of 1696 5920 D1EC.tmp 125 PID 1696 wrote to memory of 1496 1696 D2D7.tmp 126 PID 1496 wrote to memory of 4488 1496 D383.tmp 127 PID 4488 wrote to memory of 5136 4488 D46D.tmp 128 PID 5136 wrote to memory of 3404 5136 D538.tmp 129 PID 3404 wrote to memory of 2404 3404 D613.tmp 130 PID 2404 wrote to memory of 4732 2404 D69F.tmp 131 PID 4732 wrote to memory of 2508 4732 D78A.tmp 132 PID 2508 wrote to memory of 4192 2508 D8A3.tmp 133 PID 4192 wrote to memory of 1652 4192 D9AD.tmp 134 PID 1652 wrote to memory of 3376 1652 DA97.tmp 135 PID 3376 wrote to memory of 5408 3376 DB62.tmp 136 PID 5408 wrote to memory of 924 5408 DC5C.tmp 137 PID 924 wrote to memory of 5116 924 DD18.tmp 138 PID 5116 wrote to memory of 3468 5116 DDB4.tmp 139 PID 3468 wrote to memory of 4764 3468 DE31.tmp 140 PID 4764 wrote to memory of 3340 4764 DECD.tmp 141 PID 3340 wrote to memory of 3704 3340 DF4A.tmp 142 PID 3704 wrote to memory of 5460 3704 DFE6.tmp 143 PID 5460 wrote to memory of 240 5460 E092.tmp 144 PID 240 wrote to memory of 4236 240 E11F.tmp 145 PID 4236 wrote to memory of 3976 4236 E1AC.tmp 146 PID 3976 wrote to memory of 5500 3976 E248.tmp 147 PID 5500 wrote to memory of 2476 5500 E2E4.tmp 148 PID 2476 wrote to memory of 6120 2476 E371.tmp 149 PID 6120 wrote to memory of 5512 6120 E3EE.tmp 150 PID 5512 wrote to memory of 1104 5512 E49A.tmp 151 PID 1104 wrote to memory of 5216 1104 E507.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_71e951a873137385b9068414e8855d25_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_71e951a873137385b9068414e8855d25_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\A762.tmp"C:\Users\Admin\AppData\Local\Temp\A762.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\AC82.tmp"C:\Users\Admin\AppData\Local\Temp\AC82.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\AE09.tmp"C:\Users\Admin\AppData\Local\Temp\AE09.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\AF32.tmp"C:\Users\Admin\AppData\Local\Temp\AF32.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\B03B.tmp"C:\Users\Admin\AppData\Local\Temp\B03B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\B55C.tmp"C:\Users\Admin\AppData\Local\Temp\B55C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\BB67.tmp"C:\Users\Admin\AppData\Local\Temp\BB67.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\BCBE.tmp"C:\Users\Admin\AppData\Local\Temp\BCBE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\BE35.tmp"C:\Users\Admin\AppData\Local\Temp\BE35.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\C25C.tmp"C:\Users\Admin\AppData\Local\Temp\C25C.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\C394.tmp"C:\Users\Admin\AppData\Local\Temp\C394.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\C4CD.tmp"C:\Users\Admin\AppData\Local\Temp\C4CD.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\C605.tmp"C:\Users\Admin\AppData\Local\Temp\C605.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\C77C.tmp"C:\Users\Admin\AppData\Local\Temp\C77C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\C9AF.tmp"C:\Users\Admin\AppData\Local\Temp\C9AF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\CC10.tmp"C:\Users\Admin\AppData\Local\Temp\CC10.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\CE33.tmp"C:\Users\Admin\AppData\Local\Temp\CE33.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\D383.tmp"C:\Users\Admin\AppData\Local\Temp\D383.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\D46D.tmp"C:\Users\Admin\AppData\Local\Temp\D46D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\D538.tmp"C:\Users\Admin\AppData\Local\Temp\D538.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\D613.tmp"C:\Users\Admin\AppData\Local\Temp\D613.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\D69F.tmp"C:\Users\Admin\AppData\Local\Temp\D69F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\DA97.tmp"C:\Users\Admin\AppData\Local\Temp\DA97.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\DB62.tmp"C:\Users\Admin\AppData\Local\Temp\DB62.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\DC5C.tmp"C:\Users\Admin\AppData\Local\Temp\DC5C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\DD18.tmp"C:\Users\Admin\AppData\Local\Temp\DD18.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\DE31.tmp"C:\Users\Admin\AppData\Local\Temp\DE31.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\DECD.tmp"C:\Users\Admin\AppData\Local\Temp\DECD.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\E092.tmp"C:\Users\Admin\AppData\Local\Temp\E092.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\E11F.tmp"C:\Users\Admin\AppData\Local\Temp\E11F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\E248.tmp"C:\Users\Admin\AppData\Local\Temp\E248.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\E2E4.tmp"C:\Users\Admin\AppData\Local\Temp\E2E4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\E371.tmp"C:\Users\Admin\AppData\Local\Temp\E371.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\E49A.tmp"C:\Users\Admin\AppData\Local\Temp\E49A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\E507.tmp"C:\Users\Admin\AppData\Local\Temp\E507.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"65⤵
- Executes dropped EXE
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\E630.tmp"C:\Users\Admin\AppData\Local\Temp\E630.tmp"66⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\E6CC.tmp"C:\Users\Admin\AppData\Local\Temp\E6CC.tmp"67⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\E759.tmp"C:\Users\Admin\AppData\Local\Temp\E759.tmp"68⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"69⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\E872.tmp"C:\Users\Admin\AppData\Local\Temp\E872.tmp"70⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\E92D.tmp"C:\Users\Admin\AppData\Local\Temp\E92D.tmp"71⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"72⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\EA56.tmp"C:\Users\Admin\AppData\Local\Temp\EA56.tmp"73⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"74⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"75⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"76⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"79⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"80⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\EF09.tmp"C:\Users\Admin\AppData\Local\Temp\EF09.tmp"81⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\EF86.tmp"C:\Users\Admin\AppData\Local\Temp\EF86.tmp"82⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\F013.tmp"C:\Users\Admin\AppData\Local\Temp\F013.tmp"83⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\F090.tmp"C:\Users\Admin\AppData\Local\Temp\F090.tmp"84⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\F11D.tmp"C:\Users\Admin\AppData\Local\Temp\F11D.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"86⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\F255.tmp"C:\Users\Admin\AppData\Local\Temp\F255.tmp"87⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"88⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\F39D.tmp"C:\Users\Admin\AppData\Local\Temp\F39D.tmp"89⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\F43A.tmp"C:\Users\Admin\AppData\Local\Temp\F43A.tmp"90⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"91⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"92⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"93⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\F66C.tmp"C:\Users\Admin\AppData\Local\Temp\F66C.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\F747.tmp"C:\Users\Admin\AppData\Local\Temp\F747.tmp"95⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"96⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\F860.tmp"C:\Users\Admin\AppData\Local\Temp\F860.tmp"97⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"98⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\F989.tmp"C:\Users\Admin\AppData\Local\Temp\F989.tmp"99⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\FA06.tmp"C:\Users\Admin\AppData\Local\Temp\FA06.tmp"100⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"101⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\FB2F.tmp"C:\Users\Admin\AppData\Local\Temp\FB2F.tmp"102⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"103⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\FC58.tmp"C:\Users\Admin\AppData\Local\Temp\FC58.tmp"104⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"105⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\FD61.tmp"C:\Users\Admin\AppData\Local\Temp\FD61.tmp"106⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"107⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"108⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"109⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:432 -
C:\Users\Admin\AppData\Local\Temp\11.tmp"C:\Users\Admin\AppData\Local\Temp\11.tmp"111⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\AD.tmp"C:\Users\Admin\AppData\Local\Temp\AD.tmp"112⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\13A.tmp"C:\Users\Admin\AppData\Local\Temp\13A.tmp"113⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\1C6.tmp"C:\Users\Admin\AppData\Local\Temp\1C6.tmp"114⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\263.tmp"C:\Users\Admin\AppData\Local\Temp\263.tmp"115⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\2D0.tmp"C:\Users\Admin\AppData\Local\Temp\2D0.tmp"116⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\37C.tmp"C:\Users\Admin\AppData\Local\Temp\37C.tmp"117⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\418.tmp"C:\Users\Admin\AppData\Local\Temp\418.tmp"118⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\4C4.tmp"C:\Users\Admin\AppData\Local\Temp\4C4.tmp"119⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\551.tmp"C:\Users\Admin\AppData\Local\Temp\551.tmp"120⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\5FC.tmp"C:\Users\Admin\AppData\Local\Temp\5FC.tmp"121⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\6A8.tmp"C:\Users\Admin\AppData\Local\Temp\6A8.tmp"122⤵PID:1476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-