Analysis
- max time kernel
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 02:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_e938fbacb26bb1d3d2e14259091cf49f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_e938fbacb26bb1d3d2e14259091cf49f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-08_e938fbacb26bb1d3d2e14259091cf49f_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260808-cykr2a1vex
- SHA256 8ffe251f819cf000782474b29ba3e149289940663fd8033b9c2e5dd8e5a4a1a2
- MD5 e938fbacb26bb1d3d2e14259091cf49f
- SHA1 b7922ed996193f56205a2e5f6635752419bc7f55
- SHA512 4bea1b49d2337b7baac871573eddfc4cb952c38f72d271db966c474a8fc66649be82415852f34bfc93c096bed329c7488436cea77d6ce6bb459b4a100e0a9ac5
- SSDEEP 12288:wU5rCOTeiDODw8lNH72CAv+NRNZ+3/v+I9hUG2VA:wUQOJD2RloCAWrNGEA
- TLSH T1A9E4D12173D8C536E9FB037859B9E6514D7EBD226722D6CF2F8056AE09B1BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3348 85E0.tmp 2760 86DA.tmp 6004 8785.tmp 3768 8812.tmp 3416 8999.tmp 5340 8AA2.tmp 4620 8BBC.tmp 3604 8C87.tmp 244 8DA0.tmp 5864 8E5B.tmp 4128 8F36.tmp 5072 904F.tmp 5532 9159.tmp 3496 9234.tmp 796 936C.tmp 1224 9495.tmp 4544 95AE.tmp 1812 96D7.tmp 1172 97D1.tmp 4444 98EB.tmp 1124 99D5.tmp 3404 9ADF.tmp 1636 9BB9.tmp 1036 9CD3.tmp 3764 9DBD.tmp 1612 9EE6.tmp 1396 A00F.tmp 3000 A0E9.tmp 3340 A203.tmp 3140 A2DD.tmp 1204 A3B8.tmp 6048 A4A3.tmp 1144 A5AC.tmp 4384 A658.tmp 3960 A6F4.tmp 4948 A7B0.tmp 3968 A85C.tmp 2868 A8F8.tmp 4288 A985.tmp 5476 AA5F.tmp 5840 AB59.tmp 5900 AC15.tmp 692 ACB1.tmp 1696 AD4D.tmp 1556 ADF9.tmp 712 AE86.tmp 4076 AF9F.tmp 4420 B03B.tmp 792 B0E7.tmp 3476 B164.tmp 3620 B1F1.tmp 3512 B28D.tmp 1056 B387.tmp 3344 B404.tmp 2212 B481.tmp 2584 B51D.tmp 1684 B59A.tmp 6028 B608.tmp 4476 B694.tmp 2920 B721.tmp 1288 B79E.tmp 2756 B80B.tmp 752 B898.tmp 4256 B934.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A85C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E39B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D95F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 710B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 668B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D13C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1142.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1866.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 665.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 854E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93E5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3728 wrote to memory of 3348 3728 2026-08-08_e938fbacb26bb1d3d2e14259091cf49f_elex_mafia_stealc_tofsee.exe 88 PID 3348 wrote to memory of 2760 3348 85E0.tmp 90 PID 2760 wrote to memory of 6004 2760 86DA.tmp 91 PID 6004 wrote to memory of 3768 6004 8785.tmp 92 PID 3768 wrote to memory of 3416 3768 8812.tmp 93 PID 3416 wrote to memory of 5340 3416 8999.tmp 94 PID 5340 wrote to memory of 4620 5340 8AA2.tmp 95 PID 4620 wrote to memory of 3604 4620 8BBC.tmp 96 PID 3604 wrote to memory of 244 3604 8C87.tmp 97 PID 244 wrote to memory of 5864 244 8DA0.tmp 98 PID 5864 wrote to memory of 4128 5864 8E5B.tmp 99 PID 4128 wrote to memory of 5072 4128 8F36.tmp 100 PID 5072 wrote to memory of 5532 5072 904F.tmp 101 PID 5532 wrote to memory of 3496 5532 9159.tmp 102 PID 3496 wrote to memory of 796 3496 9234.tmp 103 PID 796 wrote to memory of 1224 796 936C.tmp 104 PID 1224 wrote to memory of 4544 1224 9495.tmp 105 PID 4544 wrote to memory of 1812 4544 95AE.tmp 106 PID 1812 wrote to memory of 1172 1812 96D7.tmp 107 PID 1172 wrote to memory of 4444 1172 97D1.tmp 108 PID 4444 wrote to memory of 1124 4444 98EB.tmp 109 PID 1124 wrote to memory of 3404 1124 99D5.tmp 110 PID 3404 wrote to memory of 1636 3404 9ADF.tmp 111 PID 1636 wrote to memory of 1036 1636 9BB9.tmp 112 PID 1036 wrote to memory of 3764 1036 9CD3.tmp 113 PID 3764 wrote to memory of 1612 3764 9DBD.tmp 114 PID 1612 wrote to memory of 1396 1612 9EE6.tmp 115 PID 1396 wrote to memory of 3000 1396 A00F.tmp 116 PID 3000 wrote to memory of 3340 3000 A0E9.tmp 117 PID 3340 wrote to memory of 3140 3340 A203.tmp 118 PID 3140 wrote to memory of 1204 3140 A2DD.tmp 119 PID 1204 wrote to memory of 6048 1204 A3B8.tmp 120 PID 6048 wrote to memory of 1144 6048 A4A3.tmp 121 PID 1144 wrote to memory of 4384 1144 A5AC.tmp 122 PID 4384 wrote to memory of 3960 4384 A658.tmp 123 PID 3960 wrote to memory of 4948 3960 A6F4.tmp 124 PID 4948 wrote to memory of 3968 4948 A7B0.tmp 125 PID 3968 wrote to memory of 2868 3968 A85C.tmp 126 PID 2868 wrote to memory of 4288 2868 A8F8.tmp 127 PID 4288 wrote to memory of 5476 4288 A985.tmp 128 PID 5476 wrote to memory of 5840 5476 AA5F.tmp 129 PID 5840 wrote to memory of 5900 5840 AB59.tmp 130 PID 5900 wrote to memory of 692 5900 AC15.tmp 131 PID 692 wrote to memory of 1696 692 ACB1.tmp 132 PID 1696 wrote to memory of 1556 1696 AD4D.tmp 133 PID 1556 wrote to memory of 712 1556 ADF9.tmp 134 PID 712 wrote to memory of 4076 712 AE86.tmp 135 PID 4076 wrote to memory of 4420 4076 AF9F.tmp 136 PID 4420 wrote to memory of 792 4420 B03B.tmp 137 PID 792 wrote to memory of 3476 792 B0E7.tmp 138 PID 3476 wrote to memory of 3620 3476 B164.tmp 139 PID 3620 wrote to memory of 3512 3620 B1F1.tmp 140 PID 5688 wrote to memory of 1056 5688 B31A.tmp 142 PID 1056 wrote to memory of 3344 1056 B387.tmp 143 PID 3344 wrote to memory of 2212 3344 B404.tmp 144 PID 2212 wrote to memory of 2584 2212 B481.tmp 145 PID 2584 wrote to memory of 1684 2584 B51D.tmp 146 PID 1684 wrote to memory of 6028 1684 B59A.tmp 147 PID 6028 wrote to memory of 4476 6028 B608.tmp 148 PID 4476 wrote to memory of 2920 4476 B694.tmp 149 PID 2920 wrote to memory of 1288 2920 B721.tmp 150 PID 1288 wrote to memory of 2756 1288 B79E.tmp 151 PID 2756 wrote to memory of 752 2756 B80B.tmp 152 PID 752 wrote to memory of 4256 752 B898.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_e938fbacb26bb1d3d2e14259091cf49f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e938fbacb26bb1d3d2e14259091cf49f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\85E0.tmp"C:\Users\Admin\AppData\Local\Temp\85E0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\86DA.tmp"C:\Users\Admin\AppData\Local\Temp\86DA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8785.tmp"C:\Users\Admin\AppData\Local\Temp\8785.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\8812.tmp"C:\Users\Admin\AppData\Local\Temp\8812.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\8999.tmp"C:\Users\Admin\AppData\Local\Temp\8999.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\8F36.tmp"C:\Users\Admin\AppData\Local\Temp\8F36.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\904F.tmp"C:\Users\Admin\AppData\Local\Temp\904F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\9159.tmp"C:\Users\Admin\AppData\Local\Temp\9159.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\9234.tmp"C:\Users\Admin\AppData\Local\Temp\9234.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\936C.tmp"C:\Users\Admin\AppData\Local\Temp\936C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\9495.tmp"C:\Users\Admin\AppData\Local\Temp\9495.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\95AE.tmp"C:\Users\Admin\AppData\Local\Temp\95AE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\96D7.tmp"C:\Users\Admin\AppData\Local\Temp\96D7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\97D1.tmp"C:\Users\Admin\AppData\Local\Temp\97D1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\98EB.tmp"C:\Users\Admin\AppData\Local\Temp\98EB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\99D5.tmp"C:\Users\Admin\AppData\Local\Temp\99D5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\A00F.tmp"C:\Users\Admin\AppData\Local\Temp\A00F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\A203.tmp"C:\Users\Admin\AppData\Local\Temp\A203.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\A4A3.tmp"C:\Users\Admin\AppData\Local\Temp\A4A3.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\A658.tmp"C:\Users\Admin\AppData\Local\Temp\A658.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\A85C.tmp"C:\Users\Admin\AppData\Local\Temp\A85C.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\A985.tmp"C:\Users\Admin\AppData\Local\Temp\A985.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\AB59.tmp"C:\Users\Admin\AppData\Local\Temp\AB59.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\AC15.tmp"C:\Users\Admin\AppData\Local\Temp\AC15.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\AE86.tmp"C:\Users\Admin\AppData\Local\Temp\AE86.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\B03B.tmp"C:\Users\Admin\AppData\Local\Temp\B03B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\B164.tmp"C:\Users\Admin\AppData\Local\Temp\B164.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"53⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\B31A.tmp"C:\Users\Admin\AppData\Local\Temp\B31A.tmp"54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\B404.tmp"C:\Users\Admin\AppData\Local\Temp\B404.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\B481.tmp"C:\Users\Admin\AppData\Local\Temp\B481.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\B51D.tmp"C:\Users\Admin\AppData\Local\Temp\B51D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\B59A.tmp"C:\Users\Admin\AppData\Local\Temp\B59A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\B608.tmp"C:\Users\Admin\AppData\Local\Temp\B608.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\B694.tmp"C:\Users\Admin\AppData\Local\Temp\B694.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\B721.tmp"C:\Users\Admin\AppData\Local\Temp\B721.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\B79E.tmp"C:\Users\Admin\AppData\Local\Temp\B79E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\B80B.tmp"C:\Users\Admin\AppData\Local\Temp\B80B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\B898.tmp"C:\Users\Admin\AppData\Local\Temp\B898.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\B934.tmp"C:\Users\Admin\AppData\Local\Temp\B934.tmp"66⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"67⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"68⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"69⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\BB28.tmp"C:\Users\Admin\AppData\Local\Temp\BB28.tmp"70⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"71⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\BC22.tmp"C:\Users\Admin\AppData\Local\Temp\BC22.tmp"72⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"73⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"74⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\BDA9.tmp"C:\Users\Admin\AppData\Local\Temp\BDA9.tmp"75⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\BE55.tmp"C:\Users\Admin\AppData\Local\Temp\BE55.tmp"76⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"77⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"78⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"79⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\C039.tmp"C:\Users\Admin\AppData\Local\Temp\C039.tmp"80⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\C152.tmp"C:\Users\Admin\AppData\Local\Temp\C152.tmp"82⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\C1CF.tmp"C:\Users\Admin\AppData\Local\Temp\C1CF.tmp"83⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"84⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\C356.tmp"C:\Users\Admin\AppData\Local\Temp\C356.tmp"86⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"87⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\C440.tmp"C:\Users\Admin\AppData\Local\Temp\C440.tmp"88⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"89⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\C55A.tmp"C:\Users\Admin\AppData\Local\Temp\C55A.tmp"90⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"91⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\C673.tmp"C:\Users\Admin\AppData\Local\Temp\C673.tmp"92⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"93⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\C78C.tmp"C:\Users\Admin\AppData\Local\Temp\C78C.tmp"94⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\C819.tmp"C:\Users\Admin\AppData\Local\Temp\C819.tmp"95⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\C886.tmp"C:\Users\Admin\AppData\Local\Temp\C886.tmp"96⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\C903.tmp"C:\Users\Admin\AppData\Local\Temp\C903.tmp"97⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\C970.tmp"C:\Users\Admin\AppData\Local\Temp\C970.tmp"98⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"99⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"100⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\CB26.tmp"C:\Users\Admin\AppData\Local\Temp\CB26.tmp"101⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"102⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\CC20.tmp"C:\Users\Admin\AppData\Local\Temp\CC20.tmp"103⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"104⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\CD97.tmp"C:\Users\Admin\AppData\Local\Temp\CD97.tmp"106⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\CE14.tmp"C:\Users\Admin\AppData\Local\Temp\CE14.tmp"107⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\CE72.tmp"C:\Users\Admin\AppData\Local\Temp\CE72.tmp"108⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"109⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"110⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"111⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\D075.tmp"C:\Users\Admin\AppData\Local\Temp\D075.tmp"112⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"113⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\D17F.tmp"C:\Users\Admin\AppData\Local\Temp\D17F.tmp"114⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"115⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\D298.tmp"C:\Users\Admin\AppData\Local\Temp\D298.tmp"116⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\D315.tmp"C:\Users\Admin\AppData\Local\Temp\D315.tmp"117⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\D392.tmp"C:\Users\Admin\AppData\Local\Temp\D392.tmp"118⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\D42E.tmp"C:\Users\Admin\AppData\Local\Temp\D42E.tmp"119⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\D49C.tmp"C:\Users\Admin\AppData\Local\Temp\D49C.tmp"120⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\D538.tmp"C:\Users\Admin\AppData\Local\Temp\D538.tmp"121⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\D5A5.tmp"C:\Users\Admin\AppData\Local\Temp\D5A5.tmp"122⤵PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-