Analysis
- max time kernel
120s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 12:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_5ef4ad487f325fdd2d182f78a4c24837_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_5ef4ad487f325fdd2d182f78a4c24837_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_5ef4ad487f325fdd2d182f78a4c24837_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260809-pse1taxgkf
- SHA256 13ff594157f5ba1766d76d8a0391f7f3251b5e79117bac5d8f1d5d40f93b4d49
- MD5 5ef4ad487f325fdd2d182f78a4c24837
- SHA1 2d760b8742d7dffd2749d532887b716c82bf0beb
- SHA512 97e4aa85159793e077255b16e641924eb6c42abeb43b7241d317519f82c8ee64964f2a5361f98dd4f950d67d7f0a93c7060688e1b77f51c34c8b2aa81d87b117
- SSDEEP 12288:NU5rCOTeijHMMVt6FoU3FT9OFP2+A6iqTZwlH4Hp:NUQOJjsMr6FoU3GsKTSlH4Hp
- TLSH T131B4E12AB684C133E6C202714BD6DBA26E3EBD354726A4C33B98622D2F717D19375347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4724 D5E9.tmp 4972 D685.tmp 3344 D721.tmp 3472 D82B.tmp 824 D925.tmp 5476 D9E0.tmp 5036 DAAB.tmp 4384 DB19.tmp 2868 DBD4.tmp 3228 DC51.tmp 2776 DD1C.tmp 2920 DD99.tmp 4672 DE36.tmp 6092 DEC2.tmp 2516 DF6E.tmp 5004 E02A.tmp 3980 E0D6.tmp 252 E162.tmp 1956 E1DF.tmp 2408 E26C.tmp 2560 E318.tmp 5948 E395.tmp 4520 E421.tmp 5256 E4AE.tmp 4572 E579.tmp 4152 E625.tmp 1084 E6B2.tmp 3212 E77D.tmp 5564 E848.tmp 4456 E913.tmp 3408 E9AF.tmp 5932 EA4B.tmp 1200 EAE8.tmp 2388 EB74.tmp 568 EBE2.tmp 2344 EC6E.tmp 464 ECDC.tmp 2632 ED68.tmp 5672 EDE5.tmp 4324 EE62.tmp 3340 EED0.tmp 5728 EF4D.tmp 808 EFCA.tmp 2996 F037.tmp 2332 F0B4.tmp 3500 F141.tmp 1812 F1CD.tmp 5936 F24A.tmp 2288 F2D7.tmp 1452 F344.tmp 2484 F3F0.tmp 2152 F48C.tmp 3060 F4FA.tmp 2108 F567.tmp 2760 F5E4.tmp 4984 F652.tmp 5400 F6DE.tmp 1976 F75B.tmp 5448 F7E8.tmp 4204 F884.tmp 1852 F901.tmp 4512 F98E.tmp 3316 FA1A.tmp 2060 FA97.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1851.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 771A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B859.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 715E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3143.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 406A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 280B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1474.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 375D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A941.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 279E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4107.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 100F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 814C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E02A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 323.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1D2.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4608 wrote to memory of 4724 4608 2026-08-09_5ef4ad487f325fdd2d182f78a4c24837_elex_mafia_stealc_tofsee.exe 89 PID 4724 wrote to memory of 4972 4724 D5E9.tmp 90 PID 4972 wrote to memory of 3344 4972 D685.tmp 91 PID 3344 wrote to memory of 3472 3344 D721.tmp 92 PID 3472 wrote to memory of 824 3472 D82B.tmp 93 PID 824 wrote to memory of 5476 824 D925.tmp 94 PID 5476 wrote to memory of 5036 5476 D9E0.tmp 95 PID 5036 wrote to memory of 4384 5036 DAAB.tmp 96 PID 4384 wrote to memory of 2868 4384 DB19.tmp 97 PID 2868 wrote to memory of 3228 2868 DBD4.tmp 98 PID 3228 wrote to memory of 2776 3228 DC51.tmp 99 PID 2776 wrote to memory of 2920 2776 DD1C.tmp 100 PID 2920 wrote to memory of 4672 2920 DD99.tmp 101 PID 4672 wrote to memory of 6092 4672 DE36.tmp 102 PID 6092 wrote to memory of 2516 6092 DEC2.tmp 103 PID 2516 wrote to memory of 5004 2516 DF6E.tmp 104 PID 5004 wrote to memory of 3980 5004 E02A.tmp 105 PID 3980 wrote to memory of 252 3980 E0D6.tmp 106 PID 252 wrote to memory of 1956 252 E162.tmp 107 PID 1956 wrote to memory of 2408 1956 E1DF.tmp 108 PID 2408 wrote to memory of 2560 2408 E26C.tmp 109 PID 2560 wrote to memory of 5948 2560 E318.tmp 110 PID 5948 wrote to memory of 4520 5948 E395.tmp 111 PID 4520 wrote to memory of 5256 4520 E421.tmp 112 PID 5256 wrote to memory of 4572 5256 E4AE.tmp 113 PID 4572 wrote to memory of 4152 4572 E579.tmp 114 PID 4152 wrote to memory of 1084 4152 E625.tmp 115 PID 1084 wrote to memory of 3212 1084 E6B2.tmp 116 PID 3212 wrote to memory of 5564 3212 E77D.tmp 117 PID 5564 wrote to memory of 4456 5564 E848.tmp 118 PID 4456 wrote to memory of 3408 4456 E913.tmp 119 PID 3408 wrote to memory of 5932 3408 E9AF.tmp 120 PID 5932 wrote to memory of 1200 5932 EA4B.tmp 121 PID 1200 wrote to memory of 2388 1200 EAE8.tmp 122 PID 2388 wrote to memory of 568 2388 EB74.tmp 123 PID 568 wrote to memory of 2344 568 EBE2.tmp 124 PID 2344 wrote to memory of 464 2344 EC6E.tmp 125 PID 464 wrote to memory of 2632 464 ECDC.tmp 126 PID 2632 wrote to memory of 5672 2632 ED68.tmp 127 PID 5672 wrote to memory of 4324 5672 EDE5.tmp 128 PID 4324 wrote to memory of 3340 4324 EE62.tmp 129 PID 3340 wrote to memory of 5728 3340 EED0.tmp 130 PID 5728 wrote to memory of 808 5728 EF4D.tmp 131 PID 808 wrote to memory of 2996 808 EFCA.tmp 132 PID 2996 wrote to memory of 2332 2996 F037.tmp 133 PID 2332 wrote to memory of 3500 2332 F0B4.tmp 134 PID 3500 wrote to memory of 1812 3500 F141.tmp 135 PID 1812 wrote to memory of 5936 1812 F1CD.tmp 136 PID 5936 wrote to memory of 2288 5936 F24A.tmp 137 PID 2288 wrote to memory of 1452 2288 F2D7.tmp 138 PID 1452 wrote to memory of 2484 1452 F344.tmp 139 PID 2484 wrote to memory of 2152 2484 F3F0.tmp 140 PID 2152 wrote to memory of 3060 2152 F48C.tmp 141 PID 3060 wrote to memory of 2108 3060 F4FA.tmp 142 PID 2108 wrote to memory of 2760 2108 F567.tmp 143 PID 2760 wrote to memory of 4984 2760 F5E4.tmp 144 PID 4984 wrote to memory of 5400 4984 F652.tmp 145 PID 5400 wrote to memory of 1976 5400 F6DE.tmp 146 PID 1976 wrote to memory of 5448 1976 F75B.tmp 147 PID 5448 wrote to memory of 4204 5448 F7E8.tmp 148 PID 4204 wrote to memory of 1852 4204 F884.tmp 149 PID 1852 wrote to memory of 4512 1852 F901.tmp 150 PID 4512 wrote to memory of 3316 4512 F98E.tmp 151 PID 3316 wrote to memory of 2060 3316 FA1A.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5ef4ad487f325fdd2d182f78a4c24837_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5ef4ad487f325fdd2d182f78a4c24837_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\D685.tmp"C:\Users\Admin\AppData\Local\Temp\D685.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\D721.tmp"C:\Users\Admin\AppData\Local\Temp\D721.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\D82B.tmp"C:\Users\Admin\AppData\Local\Temp\D82B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\D925.tmp"C:\Users\Admin\AppData\Local\Temp\D925.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\DB19.tmp"C:\Users\Admin\AppData\Local\Temp\DB19.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\DBD4.tmp"C:\Users\Admin\AppData\Local\Temp\DBD4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\DC51.tmp"C:\Users\Admin\AppData\Local\Temp\DC51.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\DD99.tmp"C:\Users\Admin\AppData\Local\Temp\DD99.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\DE36.tmp"C:\Users\Admin\AppData\Local\Temp\DE36.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\E162.tmp"C:\Users\Admin\AppData\Local\Temp\E162.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\E1DF.tmp"C:\Users\Admin\AppData\Local\Temp\E1DF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\E26C.tmp"C:\Users\Admin\AppData\Local\Temp\E26C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\E318.tmp"C:\Users\Admin\AppData\Local\Temp\E318.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\E395.tmp"C:\Users\Admin\AppData\Local\Temp\E395.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\E421.tmp"C:\Users\Admin\AppData\Local\Temp\E421.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\E579.tmp"C:\Users\Admin\AppData\Local\Temp\E579.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\E625.tmp"C:\Users\Admin\AppData\Local\Temp\E625.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\E6B2.tmp"C:\Users\Admin\AppData\Local\Temp\E6B2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\E77D.tmp"C:\Users\Admin\AppData\Local\Temp\E77D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\E848.tmp"C:\Users\Admin\AppData\Local\Temp\E848.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\E913.tmp"C:\Users\Admin\AppData\Local\Temp\E913.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\EA4B.tmp"C:\Users\Admin\AppData\Local\Temp\EA4B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\EAE8.tmp"C:\Users\Admin\AppData\Local\Temp\EAE8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\EB74.tmp"C:\Users\Admin\AppData\Local\Temp\EB74.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\EBE2.tmp"C:\Users\Admin\AppData\Local\Temp\EBE2.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\ECDC.tmp"C:\Users\Admin\AppData\Local\Temp\ECDC.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\ED68.tmp"C:\Users\Admin\AppData\Local\Temp\ED68.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\EDE5.tmp"C:\Users\Admin\AppData\Local\Temp\EDE5.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\EE62.tmp"C:\Users\Admin\AppData\Local\Temp\EE62.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\EED0.tmp"C:\Users\Admin\AppData\Local\Temp\EED0.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\EF4D.tmp"C:\Users\Admin\AppData\Local\Temp\EF4D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\F037.tmp"C:\Users\Admin\AppData\Local\Temp\F037.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\F0B4.tmp"C:\Users\Admin\AppData\Local\Temp\F0B4.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\F141.tmp"C:\Users\Admin\AppData\Local\Temp\F141.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\F24A.tmp"C:\Users\Admin\AppData\Local\Temp\F24A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\F48C.tmp"C:\Users\Admin\AppData\Local\Temp\F48C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\F4FA.tmp"C:\Users\Admin\AppData\Local\Temp\F4FA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\F567.tmp"C:\Users\Admin\AppData\Local\Temp\F567.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\F652.tmp"C:\Users\Admin\AppData\Local\Temp\F652.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\F6DE.tmp"C:\Users\Admin\AppData\Local\Temp\F6DE.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\F75B.tmp"C:\Users\Admin\AppData\Local\Temp\F75B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\F884.tmp"C:\Users\Admin\AppData\Local\Temp\F884.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\F901.tmp"C:\Users\Admin\AppData\Local\Temp\F901.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\F98E.tmp"C:\Users\Admin\AppData\Local\Temp\F98E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\FA1A.tmp"C:\Users\Admin\AppData\Local\Temp\FA1A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\FA97.tmp"C:\Users\Admin\AppData\Local\Temp\FA97.tmp"65⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\FB14.tmp"C:\Users\Admin\AppData\Local\Temp\FB14.tmp"66⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\FB91.tmp"C:\Users\Admin\AppData\Local\Temp\FB91.tmp"67⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\FC1E.tmp"C:\Users\Admin\AppData\Local\Temp\FC1E.tmp"68⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\FCAB.tmp"C:\Users\Admin\AppData\Local\Temp\FCAB.tmp"69⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\FD28.tmp"C:\Users\Admin\AppData\Local\Temp\FD28.tmp"70⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\FD95.tmp"C:\Users\Admin\AppData\Local\Temp\FD95.tmp"71⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\FE31.tmp"C:\Users\Admin\AppData\Local\Temp\FE31.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"73⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\FF0C.tmp"C:\Users\Admin\AppData\Local\Temp\FF0C.tmp"74⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\FF99.tmp"C:\Users\Admin\AppData\Local\Temp\FF99.tmp"75⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\6.tmp"C:\Users\Admin\AppData\Local\Temp\6.tmp"76⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\83.tmp"C:\Users\Admin\AppData\Local\Temp\83.tmp"77⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\F0.tmp"C:\Users\Admin\AppData\Local\Temp\F0.tmp"78⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\17D.tmp"C:\Users\Admin\AppData\Local\Temp\17D.tmp"79⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\219.tmp"C:\Users\Admin\AppData\Local\Temp\219.tmp"80⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2A6.tmp"C:\Users\Admin\AppData\Local\Temp\2A6.tmp"81⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\323.tmp"C:\Users\Admin\AppData\Local\Temp\323.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3AF.tmp"C:\Users\Admin\AppData\Local\Temp\3AF.tmp"83⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\42C.tmp"C:\Users\Admin\AppData\Local\Temp\42C.tmp"84⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\48A.tmp"C:\Users\Admin\AppData\Local\Temp\48A.tmp"85⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\507.tmp"C:\Users\Admin\AppData\Local\Temp\507.tmp"86⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\575.tmp"C:\Users\Admin\AppData\Local\Temp\575.tmp"87⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\5E2.tmp"C:\Users\Admin\AppData\Local\Temp\5E2.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\64F.tmp"C:\Users\Admin\AppData\Local\Temp\64F.tmp"89⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\6CC.tmp"C:\Users\Admin\AppData\Local\Temp\6CC.tmp"90⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\759.tmp"C:\Users\Admin\AppData\Local\Temp\759.tmp"91⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7E6.tmp"C:\Users\Admin\AppData\Local\Temp\7E6.tmp"92⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\863.tmp"C:\Users\Admin\AppData\Local\Temp\863.tmp"93⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\8EF.tmp"C:\Users\Admin\AppData\Local\Temp\8EF.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\96C.tmp"C:\Users\Admin\AppData\Local\Temp\96C.tmp"95⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\9DA.tmp"C:\Users\Admin\AppData\Local\Temp\9DA.tmp"96⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\A66.tmp"C:\Users\Admin\AppData\Local\Temp\A66.tmp"97⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\AE3.tmp"C:\Users\Admin\AppData\Local\Temp\AE3.tmp"98⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\B60.tmp"C:\Users\Admin\AppData\Local\Temp\B60.tmp"99⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\BDD.tmp"C:\Users\Admin\AppData\Local\Temp\BDD.tmp"100⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\C6A.tmp"C:\Users\Admin\AppData\Local\Temp\C6A.tmp"101⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\CE7.tmp"C:\Users\Admin\AppData\Local\Temp\CE7.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\D54.tmp"C:\Users\Admin\AppData\Local\Temp\D54.tmp"103⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\DC2.tmp"C:\Users\Admin\AppData\Local\Temp\DC2.tmp"104⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\E4E.tmp"C:\Users\Admin\AppData\Local\Temp\E4E.tmp"105⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\EBC.tmp"C:\Users\Admin\AppData\Local\Temp\EBC.tmp"106⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\F29.tmp"C:\Users\Admin\AppData\Local\Temp\F29.tmp"107⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\FA6.tmp"C:\Users\Admin\AppData\Local\Temp\FA6.tmp"108⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\1033.tmp"C:\Users\Admin\AppData\Local\Temp\1033.tmp"109⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"110⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\112D.tmp"C:\Users\Admin\AppData\Local\Temp\112D.tmp"111⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\11AA.tmp"C:\Users\Admin\AppData\Local\Temp\11AA.tmp"112⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\1227.tmp"C:\Users\Admin\AppData\Local\Temp\1227.tmp"113⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\1294.tmp"C:\Users\Admin\AppData\Local\Temp\1294.tmp"114⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\1311.tmp"C:\Users\Admin\AppData\Local\Temp\1311.tmp"115⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\13AD.tmp"C:\Users\Admin\AppData\Local\Temp\13AD.tmp"116⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"117⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\14C6.tmp"C:\Users\Admin\AppData\Local\Temp\14C6.tmp"118⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\1553.tmp"C:\Users\Admin\AppData\Local\Temp\1553.tmp"119⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\15E0.tmp"C:\Users\Admin\AppData\Local\Temp\15E0.tmp"120⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\165D.tmp"C:\Users\Admin\AppData\Local\Temp\165D.tmp"121⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\16DA.tmp"C:\Users\Admin\AppData\Local\Temp\16DA.tmp"122⤵PID:1192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-