Analysis
- max time kernel
129s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 06:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_ebca8350f8da99a08ae2454f6e4cc668_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_ebca8350f8da99a08ae2454f6e4cc668_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-08_ebca8350f8da99a08ae2454f6e4cc668_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260808-g4e6ysvxez
- SHA256 fcb44303920a353fd1f1010d9ffbb51b266a67064ac12c5c2fc3a0f8effc6178
- MD5 ebca8350f8da99a08ae2454f6e4cc668
- SHA1 0081211b40db782ee976d4df9f95d1cf215a3fd0
- SHA512 410c228af083649663d75adc832af013934eeebe970381889a65c19e9cb33a24046bc6c5a46045a76abcefcd1822013e0ce33c2da8f89626d61a6346bb866306
- SSDEEP 12288:wU5rCOTeiD3K4wN151gC+ath3/cNZ+3/v+I9hUG2VA:wUQOJD3hg517+atFUNGEA
- TLSH T1B7E4E02173D88536E9F7037859B5F6614D7EBD22A722D6CF2F8012AE19B1BC08671723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2192 4A78.tmp 3380 4BA1.tmp 2896 4CC9.tmp 2816 4E21.tmp 4076 4EDD.tmp 1228 4FA8.tmp 2588 5015.tmp 4160 510F.tmp 4116 5296.tmp 6072 540D.tmp 1836 5507.tmp 1896 5601.tmp 2788 5749.tmp 1028 5872.tmp 4824 59AA.tmp 4596 5AD3.tmp 3748 5C3B.tmp 4576 5D35.tmp 5104 5EBB.tmp 3480 6003.tmp 1952 611D.tmp 5420 6274.tmp 5780 636E.tmp 2556 6468.tmp 3248 6562.tmp 2124 669B.tmp 1100 67D3.tmp 5996 690C.tmp 3304 6A35.tmp 760 6B0F.tmp 3068 6C19.tmp 2968 6D13.tmp 468 6E1D.tmp 2368 6EA9.tmp 2564 6F84.tmp 356 7001.tmp 2032 70AD.tmp 5980 7159.tmp 2324 7214.tmp 5432 72C0.tmp 5672 734D.tmp 5920 73E9.tmp 5536 74B4.tmp 4556 7541.tmp 3860 763B.tmp 1288 76D7.tmp 940 7793.tmp 1728 785E.tmp 1780 78FA.tmp 5752 7977.tmp 4432 7A04.tmp 5236 7A90.tmp 5460 7AFE.tmp 4820 7B8A.tmp 4048 7C17.tmp 1424 7CA3.tmp 4024 7D20.tmp 4040 7DBD.tmp 3548 7E3A.tmp 3984 7ED6.tmp 4600 7F53.tmp 5348 7FE0.tmp 4176 806C.tmp 3276 80E9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E684.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A862.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B91B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 122D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B547.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D60E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A034.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 289E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2518.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2811.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 298D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B032.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C15D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C540.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 752C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E878.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A787.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D581.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7FB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2800 wrote to memory of 2192 2800 2026-08-08_ebca8350f8da99a08ae2454f6e4cc668_elex_mafia_stealc_tofsee.exe 88 PID 2192 wrote to memory of 3380 2192 4A78.tmp 89 PID 3380 wrote to memory of 2896 3380 4BA1.tmp 90 PID 2896 wrote to memory of 2816 2896 4CC9.tmp 91 PID 2816 wrote to memory of 4076 2816 4E21.tmp 92 PID 4076 wrote to memory of 1228 4076 4EDD.tmp 93 PID 1228 wrote to memory of 2588 1228 4FA8.tmp 94 PID 2588 wrote to memory of 4160 2588 5015.tmp 95 PID 4160 wrote to memory of 4116 4160 510F.tmp 96 PID 4116 wrote to memory of 6072 4116 5296.tmp 97 PID 6072 wrote to memory of 1836 6072 540D.tmp 98 PID 1836 wrote to memory of 1896 1836 5507.tmp 99 PID 1896 wrote to memory of 2788 1896 5601.tmp 100 PID 2788 wrote to memory of 1028 2788 5749.tmp 101 PID 1028 wrote to memory of 4824 1028 5872.tmp 102 PID 4824 wrote to memory of 4596 4824 59AA.tmp 103 PID 4596 wrote to memory of 3748 4596 5AD3.tmp 104 PID 3748 wrote to memory of 4576 3748 5C3B.tmp 105 PID 4576 wrote to memory of 5104 4576 5D35.tmp 106 PID 5104 wrote to memory of 3480 5104 5EBB.tmp 107 PID 3480 wrote to memory of 1952 3480 6003.tmp 108 PID 1952 wrote to memory of 5420 1952 611D.tmp 109 PID 5420 wrote to memory of 5780 5420 6274.tmp 110 PID 5780 wrote to memory of 2556 5780 636E.tmp 111 PID 2556 wrote to memory of 3248 2556 6468.tmp 112 PID 3248 wrote to memory of 2124 3248 6562.tmp 113 PID 2124 wrote to memory of 1100 2124 669B.tmp 114 PID 1100 wrote to memory of 5996 1100 67D3.tmp 115 PID 5996 wrote to memory of 3304 5996 690C.tmp 116 PID 3304 wrote to memory of 760 3304 6A35.tmp 117 PID 760 wrote to memory of 3068 760 6B0F.tmp 118 PID 3068 wrote to memory of 2968 3068 6C19.tmp 119 PID 2968 wrote to memory of 468 2968 6D13.tmp 120 PID 468 wrote to memory of 2368 468 6E1D.tmp 121 PID 2368 wrote to memory of 2564 2368 6EA9.tmp 122 PID 2564 wrote to memory of 356 2564 6F84.tmp 123 PID 356 wrote to memory of 2032 356 7001.tmp 124 PID 2032 wrote to memory of 5980 2032 70AD.tmp 125 PID 5980 wrote to memory of 2324 5980 7159.tmp 126 PID 2324 wrote to memory of 5432 2324 7214.tmp 127 PID 5432 wrote to memory of 5672 5432 72C0.tmp 128 PID 5672 wrote to memory of 5920 5672 734D.tmp 129 PID 5920 wrote to memory of 5536 5920 73E9.tmp 130 PID 5536 wrote to memory of 4556 5536 74B4.tmp 131 PID 4556 wrote to memory of 3860 4556 7541.tmp 132 PID 3860 wrote to memory of 1288 3860 763B.tmp 133 PID 1288 wrote to memory of 940 1288 76D7.tmp 134 PID 940 wrote to memory of 1728 940 7793.tmp 135 PID 1728 wrote to memory of 1780 1728 785E.tmp 136 PID 1780 wrote to memory of 5752 1780 78FA.tmp 137 PID 5752 wrote to memory of 4432 5752 7977.tmp 138 PID 4432 wrote to memory of 5236 4432 7A04.tmp 139 PID 5236 wrote to memory of 5460 5236 7A90.tmp 140 PID 5460 wrote to memory of 4820 5460 7AFE.tmp 141 PID 4820 wrote to memory of 4048 4820 7B8A.tmp 142 PID 4048 wrote to memory of 1424 4048 7C17.tmp 143 PID 1424 wrote to memory of 4024 1424 7CA3.tmp 144 PID 4024 wrote to memory of 4040 4024 7D20.tmp 145 PID 4040 wrote to memory of 3548 4040 7DBD.tmp 146 PID 3548 wrote to memory of 3984 3548 7E3A.tmp 147 PID 3984 wrote to memory of 4600 3984 7ED6.tmp 148 PID 4600 wrote to memory of 5348 4600 7F53.tmp 149 PID 5348 wrote to memory of 4176 5348 7FE0.tmp 150 PID 4176 wrote to memory of 3276 4176 806C.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_ebca8350f8da99a08ae2454f6e4cc668_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_ebca8350f8da99a08ae2454f6e4cc668_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\4BA1.tmp"C:\Users\Admin\AppData\Local\Temp\4BA1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4E21.tmp"C:\Users\Admin\AppData\Local\Temp\4E21.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\4EDD.tmp"C:\Users\Admin\AppData\Local\Temp\4EDD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\4FA8.tmp"C:\Users\Admin\AppData\Local\Temp\4FA8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\5015.tmp"C:\Users\Admin\AppData\Local\Temp\5015.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\510F.tmp"C:\Users\Admin\AppData\Local\Temp\510F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\5296.tmp"C:\Users\Admin\AppData\Local\Temp\5296.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\540D.tmp"C:\Users\Admin\AppData\Local\Temp\540D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\5507.tmp"C:\Users\Admin\AppData\Local\Temp\5507.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\5601.tmp"C:\Users\Admin\AppData\Local\Temp\5601.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\5749.tmp"C:\Users\Admin\AppData\Local\Temp\5749.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\5872.tmp"C:\Users\Admin\AppData\Local\Temp\5872.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\59AA.tmp"C:\Users\Admin\AppData\Local\Temp\59AA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\5AD3.tmp"C:\Users\Admin\AppData\Local\Temp\5AD3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\5C3B.tmp"C:\Users\Admin\AppData\Local\Temp\5C3B.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\5D35.tmp"C:\Users\Admin\AppData\Local\Temp\5D35.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\5EBB.tmp"C:\Users\Admin\AppData\Local\Temp\5EBB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\6003.tmp"C:\Users\Admin\AppData\Local\Temp\6003.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\611D.tmp"C:\Users\Admin\AppData\Local\Temp\611D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\6274.tmp"C:\Users\Admin\AppData\Local\Temp\6274.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\636E.tmp"C:\Users\Admin\AppData\Local\Temp\636E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\6468.tmp"C:\Users\Admin\AppData\Local\Temp\6468.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\6562.tmp"C:\Users\Admin\AppData\Local\Temp\6562.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\669B.tmp"C:\Users\Admin\AppData\Local\Temp\669B.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\67D3.tmp"C:\Users\Admin\AppData\Local\Temp\67D3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\690C.tmp"C:\Users\Admin\AppData\Local\Temp\690C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\6A35.tmp"C:\Users\Admin\AppData\Local\Temp\6A35.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\6B0F.tmp"C:\Users\Admin\AppData\Local\Temp\6B0F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\6C19.tmp"C:\Users\Admin\AppData\Local\Temp\6C19.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\6D13.tmp"C:\Users\Admin\AppData\Local\Temp\6D13.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\6E1D.tmp"C:\Users\Admin\AppData\Local\Temp\6E1D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\6EA9.tmp"C:\Users\Admin\AppData\Local\Temp\6EA9.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\6F84.tmp"C:\Users\Admin\AppData\Local\Temp\6F84.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\7001.tmp"C:\Users\Admin\AppData\Local\Temp\7001.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\7159.tmp"C:\Users\Admin\AppData\Local\Temp\7159.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\734D.tmp"C:\Users\Admin\AppData\Local\Temp\734D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\73E9.tmp"C:\Users\Admin\AppData\Local\Temp\73E9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\74B4.tmp"C:\Users\Admin\AppData\Local\Temp\74B4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\7541.tmp"C:\Users\Admin\AppData\Local\Temp\7541.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\763B.tmp"C:\Users\Admin\AppData\Local\Temp\763B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\76D7.tmp"C:\Users\Admin\AppData\Local\Temp\76D7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\7793.tmp"C:\Users\Admin\AppData\Local\Temp\7793.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\785E.tmp"C:\Users\Admin\AppData\Local\Temp\785E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\78FA.tmp"C:\Users\Admin\AppData\Local\Temp\78FA.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7977.tmp"C:\Users\Admin\AppData\Local\Temp\7977.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\7A04.tmp"C:\Users\Admin\AppData\Local\Temp\7A04.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\7A90.tmp"C:\Users\Admin\AppData\Local\Temp\7A90.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\7C17.tmp"C:\Users\Admin\AppData\Local\Temp\7C17.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\7CA3.tmp"C:\Users\Admin\AppData\Local\Temp\7CA3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\7D20.tmp"C:\Users\Admin\AppData\Local\Temp\7D20.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\7ED6.tmp"C:\Users\Admin\AppData\Local\Temp\7ED6.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\7F53.tmp"C:\Users\Admin\AppData\Local\Temp\7F53.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\7FE0.tmp"C:\Users\Admin\AppData\Local\Temp\7FE0.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\806C.tmp"C:\Users\Admin\AppData\Local\Temp\806C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\80E9.tmp"C:\Users\Admin\AppData\Local\Temp\80E9.tmp"65⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\8166.tmp"C:\Users\Admin\AppData\Local\Temp\8166.tmp"66⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\81F3.tmp"C:\Users\Admin\AppData\Local\Temp\81F3.tmp"67⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\8270.tmp"C:\Users\Admin\AppData\Local\Temp\8270.tmp"68⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\82DD.tmp"C:\Users\Admin\AppData\Local\Temp\82DD.tmp"69⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\836A.tmp"C:\Users\Admin\AppData\Local\Temp\836A.tmp"70⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\8406.tmp"C:\Users\Admin\AppData\Local\Temp\8406.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\8493.tmp"C:\Users\Admin\AppData\Local\Temp\8493.tmp"72⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\851F.tmp"C:\Users\Admin\AppData\Local\Temp\851F.tmp"73⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\85AC.tmp"C:\Users\Admin\AppData\Local\Temp\85AC.tmp"74⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\8639.tmp"C:\Users\Admin\AppData\Local\Temp\8639.tmp"75⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\86C5.tmp"C:\Users\Admin\AppData\Local\Temp\86C5.tmp"76⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\8752.tmp"C:\Users\Admin\AppData\Local\Temp\8752.tmp"77⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\87BF.tmp"C:\Users\Admin\AppData\Local\Temp\87BF.tmp"78⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\884C.tmp"C:\Users\Admin\AppData\Local\Temp\884C.tmp"79⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\88D8.tmp"C:\Users\Admin\AppData\Local\Temp\88D8.tmp"80⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\8965.tmp"C:\Users\Admin\AppData\Local\Temp\8965.tmp"81⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\89D2.tmp"C:\Users\Admin\AppData\Local\Temp\89D2.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\8A5F.tmp"C:\Users\Admin\AppData\Local\Temp\8A5F.tmp"83⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\8ADC.tmp"C:\Users\Admin\AppData\Local\Temp\8ADC.tmp"84⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\8B78.tmp"C:\Users\Admin\AppData\Local\Temp\8B78.tmp"85⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\8C05.tmp"C:\Users\Admin\AppData\Local\Temp\8C05.tmp"86⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\8C82.tmp"C:\Users\Admin\AppData\Local\Temp\8C82.tmp"87⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\8CFF.tmp"C:\Users\Admin\AppData\Local\Temp\8CFF.tmp"88⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\8D7C.tmp"C:\Users\Admin\AppData\Local\Temp\8D7C.tmp"89⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\8E09.tmp"C:\Users\Admin\AppData\Local\Temp\8E09.tmp"90⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\8E76.tmp"C:\Users\Admin\AppData\Local\Temp\8E76.tmp"91⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\8F22.tmp"C:\Users\Admin\AppData\Local\Temp\8F22.tmp"92⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\8FBE.tmp"C:\Users\Admin\AppData\Local\Temp\8FBE.tmp"93⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\903B.tmp"C:\Users\Admin\AppData\Local\Temp\903B.tmp"94⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\90C8.tmp"C:\Users\Admin\AppData\Local\Temp\90C8.tmp"95⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\9135.tmp"C:\Users\Admin\AppData\Local\Temp\9135.tmp"96⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\91D1.tmp"C:\Users\Admin\AppData\Local\Temp\91D1.tmp"97⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\924E.tmp"C:\Users\Admin\AppData\Local\Temp\924E.tmp"98⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\92CB.tmp"C:\Users\Admin\AppData\Local\Temp\92CB.tmp"99⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\9348.tmp"C:\Users\Admin\AppData\Local\Temp\9348.tmp"100⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\93C5.tmp"C:\Users\Admin\AppData\Local\Temp\93C5.tmp"101⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\9462.tmp"C:\Users\Admin\AppData\Local\Temp\9462.tmp"102⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\94CF.tmp"C:\Users\Admin\AppData\Local\Temp\94CF.tmp"103⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\953C.tmp"C:\Users\Admin\AppData\Local\Temp\953C.tmp"104⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\9607.tmp"C:\Users\Admin\AppData\Local\Temp\9607.tmp"105⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"106⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\96E2.tmp"C:\Users\Admin\AppData\Local\Temp\96E2.tmp"107⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"108⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\984A.tmp"C:\Users\Admin\AppData\Local\Temp\984A.tmp"110⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\98C7.tmp"C:\Users\Admin\AppData\Local\Temp\98C7.tmp"111⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\9934.tmp"C:\Users\Admin\AppData\Local\Temp\9934.tmp"112⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\99B1.tmp"C:\Users\Admin\AppData\Local\Temp\99B1.tmp"113⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\9A3E.tmp"C:\Users\Admin\AppData\Local\Temp\9A3E.tmp"114⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\9ACA.tmp"C:\Users\Admin\AppData\Local\Temp\9ACA.tmp"115⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\9B57.tmp"C:\Users\Admin\AppData\Local\Temp\9B57.tmp"116⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\9BE3.tmp"C:\Users\Admin\AppData\Local\Temp\9BE3.tmp"117⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\9C51.tmp"C:\Users\Admin\AppData\Local\Temp\9C51.tmp"118⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\9CCE.tmp"C:\Users\Admin\AppData\Local\Temp\9CCE.tmp"119⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\9D4B.tmp"C:\Users\Admin\AppData\Local\Temp\9D4B.tmp"120⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"121⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\9E74.tmp"C:\Users\Admin\AppData\Local\Temp\9E74.tmp"122⤵PID:5440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-