Analysis
- max time kernel
94s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 15:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_fc54c609d41bc6b0b2a9e3a40bdc28be_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_fc54c609d41bc6b0b2a9e3a40bdc28be_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-07_fc54c609d41bc6b0b2a9e3a40bdc28be_elex_mafia_stealc_tofsee.exe
- Size 541KB
- Sample260807-sdxtvsxgjh
- SHA256 08bde209de86322724578873c1df4280ee991329a3adfda6e34b3704737152f1
- MD5 fc54c609d41bc6b0b2a9e3a40bdc28be
- SHA1 d87adfea6946a078d0379a73c6b8d538099edd8a
- SHA512 fc8954f978c7b19de2ae52dff8af088187cd3d704ecda893414b31b03253306c4772dd4b8d0d01341d64c5652ba90819a9bf26ac14979eb075cf1231a17d9efe
- SSDEEP 12288:HU5rCOTeiJ8ZUDmS3mEiAJO+7VwKHcHEVcNZb73ctO:HUQOJJhDmS3mEigOUoJNV73ctO
- TLSH T1D5C4F125B549C232E69202710ED6EBE26A3EBD75532694C33784A27E1FB27E0D771307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4948 ABE6.tmp 3384 ACC1.tmp 1156 ADAB.tmp 3732 AE57.tmp 3220 AF41.tmp 5616 AFED.tmp 4908 B106.tmp 3824 B1B2.tmp 3932 B24F.tmp 3924 B31A.tmp 248 B3C6.tmp 2796 B452.tmp 2244 B4CF.tmp 2508 B55C.tmp 4104 B5F8.tmp 5604 B694.tmp 3464 B7FC.tmp 4160 B8A8.tmp 4524 B982.tmp 1964 BA2E.tmp 628 BACA.tmp 2060 BB67.tmp 3084 BBE4.tmp 712 BCCE.tmp 2876 BD5B.tmp 5144 BE07.tmp 2492 BEA3.tmp 1672 BF3F.tmp 2348 BFBC.tmp 1276 C049.tmp 1876 C0F5.tmp 864 C181.tmp 2388 C20E.tmp 1804 C28B.tmp 2728 C317.tmp 2040 C394.tmp 5428 C411.tmp 6032 C48E.tmp 2452 C52B.tmp 1540 C5A8.tmp 1728 C615.tmp 1472 C6B1.tmp 2756 C72E.tmp 4488 C7AB.tmp 5844 C828.tmp 420 C886.tmp 4480 C913.tmp 2552 C980.tmp 5720 C9ED.tmp 5968 CA8A.tmp 2600 CB07.tmp 6076 CB93.tmp 2900 CC20.tmp 5996 CC8D.tmp 1488 CD0A.tmp 3728 CD87.tmp 3408 CE04.tmp 2368 CE81.tmp 5944 CEFE.tmp 4484 CF7B.tmp 5268 CFE9.tmp 5360 D075.tmp 4136 D0F2.tmp 2564 D17F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D71C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6850.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B19E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F776.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4670.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 545B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9730.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E80F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9423.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B259.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D775.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 422B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 922F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 283A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A0.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 572 wrote to memory of 4948 572 2026-08-07_fc54c609d41bc6b0b2a9e3a40bdc28be_elex_mafia_stealc_tofsee.exe 89 PID 4948 wrote to memory of 3384 4948 ABE6.tmp 90 PID 3384 wrote to memory of 1156 3384 ACC1.tmp 91 PID 1156 wrote to memory of 3732 1156 ADAB.tmp 92 PID 3732 wrote to memory of 3220 3732 AE57.tmp 93 PID 3220 wrote to memory of 5616 3220 AF41.tmp 94 PID 5616 wrote to memory of 4908 5616 AFED.tmp 95 PID 4908 wrote to memory of 3824 4908 B106.tmp 96 PID 3824 wrote to memory of 3932 3824 B1B2.tmp 97 PID 3932 wrote to memory of 3924 3932 B24F.tmp 98 PID 3924 wrote to memory of 248 3924 B31A.tmp 99 PID 248 wrote to memory of 2796 248 B3C6.tmp 100 PID 2796 wrote to memory of 2244 2796 B452.tmp 101 PID 2244 wrote to memory of 2508 2244 B4CF.tmp 102 PID 2508 wrote to memory of 4104 2508 B55C.tmp 103 PID 4104 wrote to memory of 5604 4104 B5F8.tmp 104 PID 5604 wrote to memory of 3464 5604 B694.tmp 105 PID 3464 wrote to memory of 4160 3464 B7FC.tmp 106 PID 4160 wrote to memory of 4524 4160 B8A8.tmp 107 PID 4524 wrote to memory of 1964 4524 B982.tmp 108 PID 1964 wrote to memory of 628 1964 BA2E.tmp 109 PID 628 wrote to memory of 2060 628 BACA.tmp 110 PID 2060 wrote to memory of 3084 2060 BB67.tmp 111 PID 3084 wrote to memory of 712 3084 BBE4.tmp 112 PID 712 wrote to memory of 2876 712 BCCE.tmp 113 PID 2876 wrote to memory of 5144 2876 BD5B.tmp 114 PID 5144 wrote to memory of 2492 5144 BE07.tmp 115 PID 2492 wrote to memory of 1672 2492 BEA3.tmp 116 PID 1672 wrote to memory of 2348 1672 BF3F.tmp 117 PID 2348 wrote to memory of 1276 2348 BFBC.tmp 118 PID 1276 wrote to memory of 1876 1276 C049.tmp 119 PID 1876 wrote to memory of 864 1876 C0F5.tmp 120 PID 864 wrote to memory of 2388 864 C181.tmp 121 PID 2388 wrote to memory of 1804 2388 C20E.tmp 122 PID 1804 wrote to memory of 2728 1804 C28B.tmp 123 PID 2728 wrote to memory of 2040 2728 C317.tmp 124 PID 2040 wrote to memory of 5428 2040 C394.tmp 125 PID 5428 wrote to memory of 6032 5428 C411.tmp 126 PID 6032 wrote to memory of 2452 6032 C48E.tmp 127 PID 2452 wrote to memory of 1540 2452 C52B.tmp 128 PID 1540 wrote to memory of 1728 1540 C5A8.tmp 129 PID 1728 wrote to memory of 1472 1728 C615.tmp 130 PID 1472 wrote to memory of 2756 1472 C6B1.tmp 131 PID 2756 wrote to memory of 4488 2756 C72E.tmp 132 PID 4488 wrote to memory of 5844 4488 C7AB.tmp 133 PID 5844 wrote to memory of 420 5844 C828.tmp 134 PID 420 wrote to memory of 4480 420 C886.tmp 135 PID 4480 wrote to memory of 2552 4480 C913.tmp 136 PID 2552 wrote to memory of 5720 2552 C980.tmp 137 PID 5720 wrote to memory of 5968 5720 C9ED.tmp 138 PID 5968 wrote to memory of 2600 5968 CA8A.tmp 139 PID 2600 wrote to memory of 6076 2600 CB07.tmp 140 PID 6076 wrote to memory of 2900 6076 CB93.tmp 141 PID 2900 wrote to memory of 5996 2900 CC20.tmp 142 PID 5996 wrote to memory of 1488 5996 CC8D.tmp 143 PID 1488 wrote to memory of 3728 1488 CD0A.tmp 144 PID 3728 wrote to memory of 3408 3728 CD87.tmp 145 PID 3408 wrote to memory of 2368 3408 CE04.tmp 146 PID 2368 wrote to memory of 5944 2368 CE81.tmp 147 PID 5944 wrote to memory of 4484 5944 CEFE.tmp 148 PID 4484 wrote to memory of 5268 4484 CF7B.tmp 149 PID 5268 wrote to memory of 5360 5268 CFE9.tmp 150 PID 5360 wrote to memory of 4136 5360 D075.tmp 151 PID 4136 wrote to memory of 2564 4136 D0F2.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_fc54c609d41bc6b0b2a9e3a40bdc28be_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_fc54c609d41bc6b0b2a9e3a40bdc28be_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\ACC1.tmp"C:\Users\Admin\AppData\Local\Temp\ACC1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\AE57.tmp"C:\Users\Admin\AppData\Local\Temp\AE57.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\AF41.tmp"C:\Users\Admin\AppData\Local\Temp\AF41.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\AFED.tmp"C:\Users\Admin\AppData\Local\Temp\AFED.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\B31A.tmp"C:\Users\Admin\AppData\Local\Temp\B31A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\B452.tmp"C:\Users\Admin\AppData\Local\Temp\B452.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\B55C.tmp"C:\Users\Admin\AppData\Local\Temp\B55C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\B694.tmp"C:\Users\Admin\AppData\Local\Temp\B694.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\B982.tmp"C:\Users\Admin\AppData\Local\Temp\B982.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\BACA.tmp"C:\Users\Admin\AppData\Local\Temp\BACA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\BB67.tmp"C:\Users\Admin\AppData\Local\Temp\BB67.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\BBE4.tmp"C:\Users\Admin\AppData\Local\Temp\BBE4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\BE07.tmp"C:\Users\Admin\AppData\Local\Temp\BE07.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\C049.tmp"C:\Users\Admin\AppData\Local\Temp\C049.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\C181.tmp"C:\Users\Admin\AppData\Local\Temp\C181.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\C20E.tmp"C:\Users\Admin\AppData\Local\Temp\C20E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\C28B.tmp"C:\Users\Admin\AppData\Local\Temp\C28B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\C317.tmp"C:\Users\Admin\AppData\Local\Temp\C317.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\C394.tmp"C:\Users\Admin\AppData\Local\Temp\C394.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\C411.tmp"C:\Users\Admin\AppData\Local\Temp\C411.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\C48E.tmp"C:\Users\Admin\AppData\Local\Temp\C48E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\C52B.tmp"C:\Users\Admin\AppData\Local\Temp\C52B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\C615.tmp"C:\Users\Admin\AppData\Local\Temp\C615.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\C72E.tmp"C:\Users\Admin\AppData\Local\Temp\C72E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\C828.tmp"C:\Users\Admin\AppData\Local\Temp\C828.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\C886.tmp"C:\Users\Admin\AppData\Local\Temp\C886.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\C913.tmp"C:\Users\Admin\AppData\Local\Temp\C913.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\C980.tmp"C:\Users\Admin\AppData\Local\Temp\C980.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\CB07.tmp"C:\Users\Admin\AppData\Local\Temp\CB07.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\CB93.tmp"C:\Users\Admin\AppData\Local\Temp\CB93.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\CC20.tmp"C:\Users\Admin\AppData\Local\Temp\CC20.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\CD87.tmp"C:\Users\Admin\AppData\Local\Temp\CD87.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\CE04.tmp"C:\Users\Admin\AppData\Local\Temp\CE04.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\CE81.tmp"C:\Users\Admin\AppData\Local\Temp\CE81.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\CFE9.tmp"C:\Users\Admin\AppData\Local\Temp\CFE9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\D075.tmp"C:\Users\Admin\AppData\Local\Temp\D075.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\D17F.tmp"C:\Users\Admin\AppData\Local\Temp\D17F.tmp"65⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\D20C.tmp"C:\Users\Admin\AppData\Local\Temp\D20C.tmp"66⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"67⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\D325.tmp"C:\Users\Admin\AppData\Local\Temp\D325.tmp"68⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\D41F.tmp"C:\Users\Admin\AppData\Local\Temp\D41F.tmp"70⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"71⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"72⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"73⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\D632.tmp"C:\Users\Admin\AppData\Local\Temp\D632.tmp"74⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\D69F.tmp"C:\Users\Admin\AppData\Local\Temp\D69F.tmp"75⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\D71C.tmp"C:\Users\Admin\AppData\Local\Temp\D71C.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"77⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"78⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"79⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"80⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"81⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"82⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"83⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\DB43.tmp"C:\Users\Admin\AppData\Local\Temp\DB43.tmp"84⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"85⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"86⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"87⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\DD66.tmp"C:\Users\Admin\AppData\Local\Temp\DD66.tmp"88⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\DDD3.tmp"C:\Users\Admin\AppData\Local\Temp\DDD3.tmp"89⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\DE60.tmp"C:\Users\Admin\AppData\Local\Temp\DE60.tmp"90⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\DECD.tmp"C:\Users\Admin\AppData\Local\Temp\DECD.tmp"91⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\DF69.tmp"C:\Users\Admin\AppData\Local\Temp\DF69.tmp"92⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"93⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\E063.tmp"C:\Users\Admin\AppData\Local\Temp\E063.tmp"94⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\E0F0.tmp"C:\Users\Admin\AppData\Local\Temp\E0F0.tmp"95⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\E18C.tmp"C:\Users\Admin\AppData\Local\Temp\E18C.tmp"96⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\E219.tmp"C:\Users\Admin\AppData\Local\Temp\E219.tmp"97⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\E296.tmp"C:\Users\Admin\AppData\Local\Temp\E296.tmp"98⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\E303.tmp"C:\Users\Admin\AppData\Local\Temp\E303.tmp"99⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"100⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\E42C.tmp"C:\Users\Admin\AppData\Local\Temp\E42C.tmp"101⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"102⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\E526.tmp"C:\Users\Admin\AppData\Local\Temp\E526.tmp"103⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"104⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\E63F.tmp"C:\Users\Admin\AppData\Local\Temp\E63F.tmp"105⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"106⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\E739.tmp"C:\Users\Admin\AppData\Local\Temp\E739.tmp"107⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"108⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\E824.tmp"C:\Users\Admin\AppData\Local\Temp\E824.tmp"109⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\E891.tmp"C:\Users\Admin\AppData\Local\Temp\E891.tmp"110⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\E90E.tmp"C:\Users\Admin\AppData\Local\Temp\E90E.tmp"111⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\E98B.tmp"C:\Users\Admin\AppData\Local\Temp\E98B.tmp"112⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\EA08.tmp"C:\Users\Admin\AppData\Local\Temp\EA08.tmp"113⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\EAA4.tmp"C:\Users\Admin\AppData\Local\Temp\EAA4.tmp"114⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\EB21.tmp"C:\Users\Admin\AppData\Local\Temp\EB21.tmp"115⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"116⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"118⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\ED15.tmp"C:\Users\Admin\AppData\Local\Temp\ED15.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"120⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"121⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:1076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-