Analysis
- max time kernel
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 12:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_9be6a4be134678b66a6a8eb93798fd81_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_9be6a4be134678b66a6a8eb93798fd81_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-07_9be6a4be134678b66a6a8eb93798fd81_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260807-p4qlpawblc
- SHA256 1688147371e8be639f11a0a6face6e1f58c9f1ae3ac7d57c2a56131f2f286b28
- MD5 9be6a4be134678b66a6a8eb93798fd81
- SHA1 e21455ebe29bd7a7daf91ef36b4e41a5b9f8fbd1
- SHA512 d6ea5b6e2ba6c5f0556441d36ee9ac65726464edcf0e835c5a474e4c07641a2e1e11f329b813ff6c26b483f38c1e15d34c76486c0a034560c48da8a1c6290aa3
- SSDEEP 12288:NU5rCOTeijXUBVlm7eUi7xAAVfNhXmnCNTZwlH:NUQOJjECxiNFwnCNTSlH
- TLSH T1A8B4F025B685C132E5C202714FE6DBB2693ABD755726A4C33BD4A32E2FB12D1E735302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3416 B82B.tmp 3032 B9B1.tmp 2832 BA3E.tmp 5144 BAAB.tmp 2036 BB57.tmp 2444 BC51.tmp 4784 BCCE.tmp 2896 BD3B.tmp 3216 BDC8.tmp 5412 BE93.tmp 2376 BF3F.tmp 1176 BFEB.tmp 5244 C0B6.tmp 1740 C152.tmp 4796 C1DF.tmp 2928 C23D.tmp 3544 C2C9.tmp 6116 C394.tmp 2864 C402.tmp 5464 C48E.tmp 3488 C4FC.tmp 4948 C588.tmp 2088 C625.tmp 2216 C6FF.tmp 1480 C7BB.tmp 3148 C867.tmp 1368 C942.tmp 3044 C9DE.tmp 5696 CA99.tmp 1052 CB36.tmp 2960 CBA3.tmp 2296 CC4F.tmp 1044 CD0A.tmp 6120 CD87.tmp 1512 CE24.tmp 2060 CEA1.tmp 6060 CF1E.tmp 2944 CF8B.tmp 5848 D008.tmp 2876 D095.tmp 1200 D112.tmp 4820 D18F.tmp 4792 D22B.tmp 1384 D2C7.tmp 1900 D344.tmp 256 D3D1.tmp 4708 D44E.tmp 2676 D4BB.tmp 5488 D538.tmp 4176 D5E4.tmp 800 D671.tmp 1456 D6EE.tmp 2432 D75B.tmp 4228 D7D8.tmp 4100 D845.tmp 5968 D8C2.tmp 5332 D94F.tmp 416 D9DC.tmp 3348 DA59.tmp 3128 DAF5.tmp 1208 DB62.tmp 2704 DBEF.tmp 4076 DC7B.tmp 2564 DD08.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6505.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 827F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7168.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5986.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4140.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 858D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D15B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 222A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3257.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 390E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F11D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 370F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 557F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 836A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 512A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2140.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E45B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3881.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8DD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4984 wrote to memory of 3416 4984 2026-08-07_9be6a4be134678b66a6a8eb93798fd81_elex_mafia_stealc_tofsee.exe 89 PID 3416 wrote to memory of 3032 3416 B82B.tmp 90 PID 3032 wrote to memory of 2832 3032 B9B1.tmp 91 PID 2832 wrote to memory of 5144 2832 BA3E.tmp 92 PID 5144 wrote to memory of 2036 5144 BAAB.tmp 93 PID 2036 wrote to memory of 2444 2036 BB57.tmp 94 PID 2444 wrote to memory of 4784 2444 BC51.tmp 95 PID 4784 wrote to memory of 2896 4784 BCCE.tmp 96 PID 2896 wrote to memory of 3216 2896 BD3B.tmp 97 PID 3216 wrote to memory of 5412 3216 BDC8.tmp 98 PID 5412 wrote to memory of 2376 5412 BE93.tmp 99 PID 2376 wrote to memory of 1176 2376 BF3F.tmp 100 PID 1176 wrote to memory of 5244 1176 BFEB.tmp 101 PID 5244 wrote to memory of 1740 5244 C0B6.tmp 102 PID 1740 wrote to memory of 4796 1740 C152.tmp 103 PID 4796 wrote to memory of 2928 4796 C1DF.tmp 104 PID 2928 wrote to memory of 3544 2928 C23D.tmp 105 PID 3544 wrote to memory of 6116 3544 C2C9.tmp 106 PID 6116 wrote to memory of 2864 6116 C394.tmp 107 PID 2864 wrote to memory of 5464 2864 C402.tmp 108 PID 5464 wrote to memory of 3488 5464 C48E.tmp 109 PID 3488 wrote to memory of 4948 3488 C4FC.tmp 110 PID 4948 wrote to memory of 2088 4948 C588.tmp 111 PID 2088 wrote to memory of 2216 2088 C625.tmp 112 PID 2216 wrote to memory of 1480 2216 C6FF.tmp 113 PID 1480 wrote to memory of 3148 1480 C7BB.tmp 114 PID 3148 wrote to memory of 1368 3148 C867.tmp 115 PID 1368 wrote to memory of 3044 1368 C942.tmp 116 PID 3044 wrote to memory of 5696 3044 C9DE.tmp 117 PID 5696 wrote to memory of 1052 5696 CA99.tmp 118 PID 1052 wrote to memory of 2960 1052 CB36.tmp 119 PID 2960 wrote to memory of 2296 2960 CBA3.tmp 120 PID 2296 wrote to memory of 1044 2296 CC4F.tmp 121 PID 1044 wrote to memory of 6120 1044 CD0A.tmp 122 PID 6120 wrote to memory of 1512 6120 CD87.tmp 123 PID 1512 wrote to memory of 2060 1512 CE24.tmp 124 PID 2060 wrote to memory of 6060 2060 CEA1.tmp 125 PID 6060 wrote to memory of 2944 6060 CF1E.tmp 126 PID 2944 wrote to memory of 5848 2944 CF8B.tmp 127 PID 5848 wrote to memory of 2876 5848 D008.tmp 128 PID 2876 wrote to memory of 1200 2876 D095.tmp 129 PID 1200 wrote to memory of 4820 1200 D112.tmp 130 PID 4820 wrote to memory of 4792 4820 D18F.tmp 131 PID 4792 wrote to memory of 1384 4792 D22B.tmp 132 PID 1384 wrote to memory of 1900 1384 D2C7.tmp 133 PID 1900 wrote to memory of 256 1900 D344.tmp 134 PID 256 wrote to memory of 4708 256 D3D1.tmp 135 PID 4708 wrote to memory of 2676 4708 D44E.tmp 136 PID 2676 wrote to memory of 5488 2676 D4BB.tmp 137 PID 5488 wrote to memory of 4176 5488 D538.tmp 138 PID 4176 wrote to memory of 800 4176 D5E4.tmp 139 PID 800 wrote to memory of 1456 800 D671.tmp 140 PID 1456 wrote to memory of 2432 1456 D6EE.tmp 141 PID 2432 wrote to memory of 4228 2432 D75B.tmp 142 PID 4228 wrote to memory of 4100 4228 D7D8.tmp 143 PID 4100 wrote to memory of 5968 4100 D845.tmp 144 PID 5968 wrote to memory of 5332 5968 D8C2.tmp 145 PID 5332 wrote to memory of 416 5332 D94F.tmp 146 PID 416 wrote to memory of 3348 416 D9DC.tmp 147 PID 3348 wrote to memory of 3128 3348 DA59.tmp 148 PID 3128 wrote to memory of 1208 3128 DAF5.tmp 149 PID 1208 wrote to memory of 2704 1208 DB62.tmp 150 PID 2704 wrote to memory of 4076 2704 DBEF.tmp 151 PID 4076 wrote to memory of 2564 4076 DC7B.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_9be6a4be134678b66a6a8eb93798fd81_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_9be6a4be134678b66a6a8eb93798fd81_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\B82B.tmp"C:\Users\Admin\AppData\Local\Temp\B82B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\BB57.tmp"C:\Users\Admin\AppData\Local\Temp\BB57.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\BC51.tmp"C:\Users\Admin\AppData\Local\Temp\BC51.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\BE93.tmp"C:\Users\Admin\AppData\Local\Temp\BE93.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\C152.tmp"C:\Users\Admin\AppData\Local\Temp\C152.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\C23D.tmp"C:\Users\Admin\AppData\Local\Temp\C23D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\C394.tmp"C:\Users\Admin\AppData\Local\Temp\C394.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\C402.tmp"C:\Users\Admin\AppData\Local\Temp\C402.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\C48E.tmp"C:\Users\Admin\AppData\Local\Temp\C48E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\C588.tmp"C:\Users\Admin\AppData\Local\Temp\C588.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\C625.tmp"C:\Users\Admin\AppData\Local\Temp\C625.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\C7BB.tmp"C:\Users\Admin\AppData\Local\Temp\C7BB.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\C867.tmp"C:\Users\Admin\AppData\Local\Temp\C867.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\C942.tmp"C:\Users\Admin\AppData\Local\Temp\C942.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\CA99.tmp"C:\Users\Admin\AppData\Local\Temp\CA99.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\CB36.tmp"C:\Users\Admin\AppData\Local\Temp\CB36.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\CD87.tmp"C:\Users\Admin\AppData\Local\Temp\CD87.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\CE24.tmp"C:\Users\Admin\AppData\Local\Temp\CE24.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\D095.tmp"C:\Users\Admin\AppData\Local\Temp\D095.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\D112.tmp"C:\Users\Admin\AppData\Local\Temp\D112.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\D18F.tmp"C:\Users\Admin\AppData\Local\Temp\D18F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\D22B.tmp"C:\Users\Admin\AppData\Local\Temp\D22B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\D2C7.tmp"C:\Users\Admin\AppData\Local\Temp\D2C7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\D344.tmp"C:\Users\Admin\AppData\Local\Temp\D344.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\D44E.tmp"C:\Users\Admin\AppData\Local\Temp\D44E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\D4BB.tmp"C:\Users\Admin\AppData\Local\Temp\D4BB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\D538.tmp"C:\Users\Admin\AppData\Local\Temp\D538.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\D671.tmp"C:\Users\Admin\AppData\Local\Temp\D671.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\D94F.tmp"C:\Users\Admin\AppData\Local\Temp\D94F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\DA59.tmp"C:\Users\Admin\AppData\Local\Temp\DA59.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\DB62.tmp"C:\Users\Admin\AppData\Local\Temp\DB62.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\DC7B.tmp"C:\Users\Admin\AppData\Local\Temp\DC7B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\DD08.tmp"C:\Users\Admin\AppData\Local\Temp\DD08.tmp"65⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\DD85.tmp"C:\Users\Admin\AppData\Local\Temp\DD85.tmp"66⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\DE02.tmp"C:\Users\Admin\AppData\Local\Temp\DE02.tmp"67⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"68⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"69⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\DF89.tmp"C:\Users\Admin\AppData\Local\Temp\DF89.tmp"70⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\E006.tmp"C:\Users\Admin\AppData\Local\Temp\E006.tmp"71⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\E083.tmp"C:\Users\Admin\AppData\Local\Temp\E083.tmp"72⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\E11F.tmp"C:\Users\Admin\AppData\Local\Temp\E11F.tmp"73⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"74⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\E229.tmp"C:\Users\Admin\AppData\Local\Temp\E229.tmp"75⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"76⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\E323.tmp"C:\Users\Admin\AppData\Local\Temp\E323.tmp"77⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"78⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\E45B.tmp"C:\Users\Admin\AppData\Local\Temp\E45B.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"80⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\E594.tmp"C:\Users\Admin\AppData\Local\Temp\E594.tmp"81⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\E601.tmp"C:\Users\Admin\AppData\Local\Temp\E601.tmp"82⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\E68E.tmp"C:\Users\Admin\AppData\Local\Temp\E68E.tmp"83⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\E70B.tmp"C:\Users\Admin\AppData\Local\Temp\E70B.tmp"84⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\E797.tmp"C:\Users\Admin\AppData\Local\Temp\E797.tmp"85⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\E833.tmp"C:\Users\Admin\AppData\Local\Temp\E833.tmp"86⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"87⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\E94D.tmp"C:\Users\Admin\AppData\Local\Temp\E94D.tmp"88⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\E9CA.tmp"C:\Users\Admin\AppData\Local\Temp\E9CA.tmp"89⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\EA56.tmp"C:\Users\Admin\AppData\Local\Temp\EA56.tmp"90⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"91⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"92⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\EBED.tmp"C:\Users\Admin\AppData\Local\Temp\EBED.tmp"93⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"94⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"95⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\ED92.tmp"C:\Users\Admin\AppData\Local\Temp\ED92.tmp"96⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"97⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"98⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\EF29.tmp"C:\Users\Admin\AppData\Local\Temp\EF29.tmp"99⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"100⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\F023.tmp"C:\Users\Admin\AppData\Local\Temp\F023.tmp"101⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"102⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\F11D.tmp"C:\Users\Admin\AppData\Local\Temp\F11D.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"104⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\F217.tmp"C:\Users\Admin\AppData\Local\Temp\F217.tmp"105⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\F294.tmp"C:\Users\Admin\AppData\Local\Temp\F294.tmp"106⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\F311.tmp"C:\Users\Admin\AppData\Local\Temp\F311.tmp"107⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\F39D.tmp"C:\Users\Admin\AppData\Local\Temp\F39D.tmp"108⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\F42A.tmp"C:\Users\Admin\AppData\Local\Temp\F42A.tmp"109⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"110⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\F524.tmp"C:\Users\Admin\AppData\Local\Temp\F524.tmp"111⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"112⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\F61E.tmp"C:\Users\Admin\AppData\Local\Temp\F61E.tmp"113⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"114⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\F747.tmp"C:\Users\Admin\AppData\Local\Temp\F747.tmp"115⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"116⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\F870.tmp"C:\Users\Admin\AppData\Local\Temp\F870.tmp"117⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\F90C.tmp"C:\Users\Admin\AppData\Local\Temp\F90C.tmp"118⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\F999.tmp"C:\Users\Admin\AppData\Local\Temp\F999.tmp"119⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\FA25.tmp"C:\Users\Admin\AppData\Local\Temp\FA25.tmp"120⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"121⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\FB2F.tmp"C:\Users\Admin\AppData\Local\Temp\FB2F.tmp"122⤵PID:5716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-