Analysis
- max time kernel
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 19:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_91f71eaab17f3c9651ab7da179b493ac_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_91f71eaab17f3c9651ab7da179b493ac_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-09_91f71eaab17f3c9651ab7da179b493ac_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260809-yem9psvbqh
- SHA256 2fe1967f05b2f4dc415f3b2e2f7f2e109e3872e73a2b3554f093895e63dd37ec
- MD5 91f71eaab17f3c9651ab7da179b493ac
- SHA1 846619f1f0670b91fb8a6b68387325b89b9d1b09
- SHA512 ce2fe7278716fccb19d0305bf45f28f726b33f3a425fce39c00a35a58654ee80fa1fc853e426477da9d942d6adba0b87955d8842dae25bdf74e66f429e1a7e7a
- SSDEEP 12288:wU5rCOTeiDVAB52E6bx8kLwl3Ye6NZ+3/v+I9hUG2VA:wUQOJDeB52E6b+kLI3YnNGEA
- TLSH T1DBE4D02173D88532E5FB037859B5E6614E7EBD226722D6CF2F8052AE09B1BD0C671723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5960 9541.tmp 5044 966A.tmp 1528 9725.tmp 244 99F4.tmp 3748 9B3C.tmp 4984 9D01.tmp 3536 9E98.tmp 5964 A00F.tmp 5584 A1A5.tmp 2420 A2FD.tmp 1944 A4B2.tmp 4476 A5EB.tmp 2056 A752.tmp 1576 A8AA.tmp 3680 A9D3.tmp 3308 AADC.tmp 2800 AC15.tmp 1032 AD4D.tmp 2652 AE76.tmp 5424 AF8F.tmp 3564 B0D8.tmp 1048 B220.tmp 2664 B3A6.tmp 1728 B4DF.tmp 2436 B608.tmp 2024 B740.tmp 4328 B859.tmp 4208 B992.tmp 2172 BAAB.tmp 4652 BBD4.tmp 820 BD6A.tmp 2184 BEF1.tmp 5852 C068.tmp 4648 C133.tmp 6048 C23D.tmp 5456 C2E9.tmp 4384 C3B4.tmp 1472 C49E.tmp 2940 C5B7.tmp 6044 C663.tmp 1540 C75D.tmp 5212 C828.tmp 6140 C932.tmp 2884 CA1C.tmp 844 CA7A.tmp 4192 CB07.tmp 3892 CB84.tmp 2272 CC10.tmp 5012 CC8D.tmp 1416 CD0A.tmp 4560 CD78.tmp 3236 CDF5.tmp 4364 CE62.tmp 3448 CEDF.tmp 4324 CF3D.tmp 5588 CFBA.tmp 1004 D027.tmp 3148 D095.tmp 4840 D112.tmp 200 D1AE.tmp 2596 D2A8.tmp 1420 D354.tmp 5520 D3F0.tmp 1184 D48C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 958A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 271C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 537B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C23D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2910.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 566E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8984.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2135.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 5960 2364 2026-08-09_91f71eaab17f3c9651ab7da179b493ac_elex_mafia_stealc_tofsee.exe 89 PID 5960 wrote to memory of 5044 5960 9541.tmp 90 PID 5044 wrote to memory of 1528 5044 966A.tmp 91 PID 1528 wrote to memory of 244 1528 9725.tmp 92 PID 244 wrote to memory of 3748 244 99F4.tmp 93 PID 3748 wrote to memory of 4984 3748 9B3C.tmp 94 PID 4984 wrote to memory of 3536 4984 9D01.tmp 95 PID 3536 wrote to memory of 5964 3536 9E98.tmp 96 PID 5964 wrote to memory of 5584 5964 A00F.tmp 97 PID 5584 wrote to memory of 2420 5584 A1A5.tmp 98 PID 2420 wrote to memory of 1944 2420 A2FD.tmp 99 PID 1944 wrote to memory of 4476 1944 A4B2.tmp 100 PID 4476 wrote to memory of 2056 4476 A5EB.tmp 101 PID 2056 wrote to memory of 1576 2056 A752.tmp 102 PID 1576 wrote to memory of 3680 1576 A8AA.tmp 103 PID 3680 wrote to memory of 3308 3680 A9D3.tmp 104 PID 3308 wrote to memory of 2800 3308 AADC.tmp 105 PID 2800 wrote to memory of 1032 2800 AC15.tmp 106 PID 1032 wrote to memory of 2652 1032 AD4D.tmp 107 PID 2652 wrote to memory of 5424 2652 AE76.tmp 108 PID 5424 wrote to memory of 3564 5424 AF8F.tmp 109 PID 3564 wrote to memory of 1048 3564 B0D8.tmp 110 PID 1048 wrote to memory of 2664 1048 B220.tmp 111 PID 2664 wrote to memory of 1728 2664 B3A6.tmp 112 PID 1728 wrote to memory of 2436 1728 B4DF.tmp 113 PID 2436 wrote to memory of 2024 2436 B608.tmp 114 PID 2024 wrote to memory of 4328 2024 B740.tmp 115 PID 4328 wrote to memory of 4208 4328 B859.tmp 116 PID 4208 wrote to memory of 2172 4208 B992.tmp 117 PID 2172 wrote to memory of 4652 2172 BAAB.tmp 118 PID 4652 wrote to memory of 820 4652 BBD4.tmp 119 PID 820 wrote to memory of 2184 820 BD6A.tmp 120 PID 2184 wrote to memory of 5852 2184 BEF1.tmp 121 PID 5852 wrote to memory of 4648 5852 C068.tmp 122 PID 4648 wrote to memory of 6048 4648 C133.tmp 123 PID 6048 wrote to memory of 5456 6048 C23D.tmp 124 PID 5456 wrote to memory of 4384 5456 C2E9.tmp 125 PID 4384 wrote to memory of 1472 4384 C3B4.tmp 126 PID 1472 wrote to memory of 2940 1472 C49E.tmp 127 PID 2940 wrote to memory of 6044 2940 C5B7.tmp 128 PID 6044 wrote to memory of 1540 6044 C663.tmp 129 PID 1540 wrote to memory of 5212 1540 C75D.tmp 130 PID 5212 wrote to memory of 6140 5212 C828.tmp 131 PID 6140 wrote to memory of 2884 6140 C932.tmp 132 PID 2884 wrote to memory of 844 2884 CA1C.tmp 133 PID 844 wrote to memory of 4192 844 CA7A.tmp 134 PID 4192 wrote to memory of 3892 4192 CB07.tmp 135 PID 3892 wrote to memory of 2272 3892 CB84.tmp 136 PID 2272 wrote to memory of 5012 2272 CC10.tmp 137 PID 5012 wrote to memory of 1416 5012 CC8D.tmp 138 PID 1416 wrote to memory of 4560 1416 CD0A.tmp 139 PID 4560 wrote to memory of 3236 4560 CD78.tmp 140 PID 3236 wrote to memory of 4364 3236 CDF5.tmp 141 PID 4364 wrote to memory of 3448 4364 CE62.tmp 142 PID 3448 wrote to memory of 4324 3448 CEDF.tmp 143 PID 4324 wrote to memory of 5588 4324 CF3D.tmp 144 PID 5588 wrote to memory of 1004 5588 CFBA.tmp 145 PID 1004 wrote to memory of 3148 1004 D027.tmp 146 PID 3148 wrote to memory of 4840 3148 D095.tmp 147 PID 4840 wrote to memory of 200 4840 D112.tmp 148 PID 200 wrote to memory of 2596 200 D1AE.tmp 149 PID 2596 wrote to memory of 1420 2596 D2A8.tmp 150 PID 1420 wrote to memory of 5520 1420 D354.tmp 151 PID 5520 wrote to memory of 1184 5520 D3F0.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_91f71eaab17f3c9651ab7da179b493ac_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_91f71eaab17f3c9651ab7da179b493ac_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\9541.tmp"C:\Users\Admin\AppData\Local\Temp\9541.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\966A.tmp"C:\Users\Admin\AppData\Local\Temp\966A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\9725.tmp"C:\Users\Admin\AppData\Local\Temp\9725.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\99F4.tmp"C:\Users\Admin\AppData\Local\Temp\99F4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\9D01.tmp"C:\Users\Admin\AppData\Local\Temp\9D01.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\9E98.tmp"C:\Users\Admin\AppData\Local\Temp\9E98.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\A00F.tmp"C:\Users\Admin\AppData\Local\Temp\A00F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\A1A5.tmp"C:\Users\Admin\AppData\Local\Temp\A1A5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\A2FD.tmp"C:\Users\Admin\AppData\Local\Temp\A2FD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\A752.tmp"C:\Users\Admin\AppData\Local\Temp\A752.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\AADC.tmp"C:\Users\Admin\AppData\Local\Temp\AADC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\AC15.tmp"C:\Users\Admin\AppData\Local\Temp\AC15.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\AE76.tmp"C:\Users\Admin\AppData\Local\Temp\AE76.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\B608.tmp"C:\Users\Admin\AppData\Local\Temp\B608.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\B740.tmp"C:\Users\Admin\AppData\Local\Temp\B740.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\B859.tmp"C:\Users\Admin\AppData\Local\Temp\B859.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\B992.tmp"C:\Users\Admin\AppData\Local\Temp\B992.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\C068.tmp"C:\Users\Admin\AppData\Local\Temp\C068.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\C133.tmp"C:\Users\Admin\AppData\Local\Temp\C133.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\C23D.tmp"C:\Users\Admin\AppData\Local\Temp\C23D.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\C3B4.tmp"C:\Users\Admin\AppData\Local\Temp\C3B4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\C49E.tmp"C:\Users\Admin\AppData\Local\Temp\C49E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\C663.tmp"C:\Users\Admin\AppData\Local\Temp\C663.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\C75D.tmp"C:\Users\Admin\AppData\Local\Temp\C75D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\C828.tmp"C:\Users\Admin\AppData\Local\Temp\C828.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\C932.tmp"C:\Users\Admin\AppData\Local\Temp\C932.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\CA7A.tmp"C:\Users\Admin\AppData\Local\Temp\CA7A.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\CB07.tmp"C:\Users\Admin\AppData\Local\Temp\CB07.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\CB84.tmp"C:\Users\Admin\AppData\Local\Temp\CB84.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\CC10.tmp"C:\Users\Admin\AppData\Local\Temp\CC10.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\CD78.tmp"C:\Users\Admin\AppData\Local\Temp\CD78.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\CE62.tmp"C:\Users\Admin\AppData\Local\Temp\CE62.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\CFBA.tmp"C:\Users\Admin\AppData\Local\Temp\CFBA.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\D027.tmp"C:\Users\Admin\AppData\Local\Temp\D027.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\D095.tmp"C:\Users\Admin\AppData\Local\Temp\D095.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\D112.tmp"C:\Users\Admin\AppData\Local\Temp\D112.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\D354.tmp"C:\Users\Admin\AppData\Local\Temp\D354.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\D48C.tmp"C:\Users\Admin\AppData\Local\Temp\D48C.tmp"65⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\D528.tmp"C:\Users\Admin\AppData\Local\Temp\D528.tmp"66⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\D632.tmp"C:\Users\Admin\AppData\Local\Temp\D632.tmp"68⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"69⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\D74B.tmp"C:\Users\Admin\AppData\Local\Temp\D74B.tmp"70⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"72⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\D95F.tmp"C:\Users\Admin\AppData\Local\Temp\D95F.tmp"73⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"74⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\DA78.tmp"C:\Users\Admin\AppData\Local\Temp\DA78.tmp"75⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\DB14.tmp"C:\Users\Admin\AppData\Local\Temp\DB14.tmp"76⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"77⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\DD27.tmp"C:\Users\Admin\AppData\Local\Temp\DD27.tmp"80⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\DDD3.tmp"C:\Users\Admin\AppData\Local\Temp\DDD3.tmp"81⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\DE41.tmp"C:\Users\Admin\AppData\Local\Temp\DE41.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"83⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\DF69.tmp"C:\Users\Admin\AppData\Local\Temp\DF69.tmp"84⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"85⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\E083.tmp"C:\Users\Admin\AppData\Local\Temp\E083.tmp"86⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\E13E.tmp"C:\Users\Admin\AppData\Local\Temp\E13E.tmp"87⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\E1CB.tmp"C:\Users\Admin\AppData\Local\Temp\E1CB.tmp"88⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\E267.tmp"C:\Users\Admin\AppData\Local\Temp\E267.tmp"89⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\E303.tmp"C:\Users\Admin\AppData\Local\Temp\E303.tmp"90⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\E380.tmp"C:\Users\Admin\AppData\Local\Temp\E380.tmp"91⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"92⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\E49A.tmp"C:\Users\Admin\AppData\Local\Temp\E49A.tmp"93⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\E517.tmp"C:\Users\Admin\AppData\Local\Temp\E517.tmp"94⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\E594.tmp"C:\Users\Admin\AppData\Local\Temp\E594.tmp"95⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\E620.tmp"C:\Users\Admin\AppData\Local\Temp\E620.tmp"96⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\E68E.tmp"C:\Users\Admin\AppData\Local\Temp\E68E.tmp"97⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\E71A.tmp"C:\Users\Admin\AppData\Local\Temp\E71A.tmp"98⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\E788.tmp"C:\Users\Admin\AppData\Local\Temp\E788.tmp"99⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\E805.tmp"C:\Users\Admin\AppData\Local\Temp\E805.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"102⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"103⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\EA76.tmp"C:\Users\Admin\AppData\Local\Temp\EA76.tmp"104⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\EB12.tmp"C:\Users\Admin\AppData\Local\Temp\EB12.tmp"105⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"106⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"107⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"108⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\ED64.tmp"C:\Users\Admin\AppData\Local\Temp\ED64.tmp"109⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"110⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"111⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\EF38.tmp"C:\Users\Admin\AppData\Local\Temp\EF38.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"113⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\F042.tmp"C:\Users\Admin\AppData\Local\Temp\F042.tmp"114⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\F15B.tmp"C:\Users\Admin\AppData\Local\Temp\F15B.tmp"116⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"117⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\F265.tmp"C:\Users\Admin\AppData\Local\Temp\F265.tmp"118⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\F301.tmp"C:\Users\Admin\AppData\Local\Temp\F301.tmp"119⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\F3AD.tmp"C:\Users\Admin\AppData\Local\Temp\F3AD.tmp"120⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\F43A.tmp"C:\Users\Admin\AppData\Local\Temp\F43A.tmp"121⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\F4C6.tmp"C:\Users\Admin\AppData\Local\Temp\F4C6.tmp"122⤵PID:2372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-