Analysis
- max time kernel
118s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_3407ee1dd419358515b89bb90041d366_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_3407ee1dd419358515b89bb90041d366_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-10_3407ee1dd419358515b89bb90041d366_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260810-ray23sap5y
- SHA256 5932abbe26b2b7bf3f9b28d672bf9f00e87719979d3b805d33eb4c03b2b08bdb
- MD5 3407ee1dd419358515b89bb90041d366
- SHA1 63de8b66b2d9c5f62639104be2f994eebdeecea1
- SHA512 611a1688e80f1fb8ea75155295d5ac271368a0f0f5a6c5e245fff18879b7955460a3a29df1a4f60d1a6f472768d4a1f065f580edc9e122fa2eca4b2d43aa150a
- SSDEEP 12288:NU5rCOTeij/EdKcXooxWI7SMT9xkzhuSyRACvEhmSkTZwlH:NUQOJj/Eg85l7Snzhnub6kTSlH
- TLSH T1ADB4F1257545C132E69202710AE6EBB26D3E7D32572294C37B98A37E2FB23E1D375306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1440 CC10.tmp 2016 CC9D.tmp 2916 CD78.tmp 1352 CE24.tmp 2816 CEC0.tmp 2148 CF7B.tmp 4732 D027.tmp 3748 D0B4.tmp 1864 D19E.tmp 4764 D25A.tmp 2136 D306.tmp 3236 D3C1.tmp 5620 D46D.tmp 796 D538.tmp 5964 D5D4.tmp 1788 D690.tmp 5368 D70D.tmp 1124 D7F7.tmp 4412 D8C2.tmp 3316 D9BC.tmp 1116 DA59.tmp 5332 DB14.tmp 4364 DBC0.tmp 6000 DCAA.tmp 1332 DD66.tmp 2104 DE31.tmp 3496 DEEC.tmp 6020 DF89.tmp 4336 E035.tmp 5796 E10F.tmp 4008 E1AC.tmp 5456 E267.tmp 4756 E332.tmp 3164 E3AF.tmp 948 E42C.tmp 3500 E4C8.tmp 3348 E555.tmp 3564 E5D2.tmp 1304 E66E.tmp 6100 E70B.tmp 2132 E788.tmp 200 E833.tmp 1052 E8C0.tmp 1568 E94D.tmp 3568 E9F9.tmp 4604 EA95.tmp 4700 EB02.tmp 2748 EB7F.tmp 2276 EC1B.tmp 2172 EC98.tmp 3408 ED25.tmp 4368 EDC1.tmp 4424 EE6D.tmp 3844 EF19.tmp 1188 EF86.tmp 3692 F013.tmp 4252 F0AF.tmp 3836 F14C.tmp 3776 F1D8.tmp 932 F265.tmp 1184 F2F1.tmp 5324 F36E.tmp 1560 F3FB.tmp 3968 F478.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 217F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 693B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F742.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D70D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 154E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 545B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9859.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9382.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D19E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5610.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8970.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 681D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46D9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5852 wrote to memory of 1440 5852 2026-08-10_3407ee1dd419358515b89bb90041d366_elex_mafia_stealc_tofsee.exe 88 PID 1440 wrote to memory of 2016 1440 CC10.tmp 89 PID 2016 wrote to memory of 2916 2016 CC9D.tmp 90 PID 2916 wrote to memory of 1352 2916 CD78.tmp 91 PID 1352 wrote to memory of 2816 1352 CE24.tmp 92 PID 2816 wrote to memory of 2148 2816 CEC0.tmp 93 PID 2148 wrote to memory of 4732 2148 CF7B.tmp 94 PID 4732 wrote to memory of 3748 4732 D027.tmp 95 PID 3748 wrote to memory of 1864 3748 D0B4.tmp 96 PID 1864 wrote to memory of 4764 1864 D19E.tmp 97 PID 4764 wrote to memory of 2136 4764 D25A.tmp 98 PID 2136 wrote to memory of 3236 2136 D306.tmp 99 PID 3236 wrote to memory of 5620 3236 D3C1.tmp 100 PID 5620 wrote to memory of 796 5620 D46D.tmp 101 PID 796 wrote to memory of 5964 796 D538.tmp 102 PID 5964 wrote to memory of 1788 5964 D5D4.tmp 103 PID 1788 wrote to memory of 5368 1788 D690.tmp 104 PID 5368 wrote to memory of 1124 5368 D70D.tmp 105 PID 1124 wrote to memory of 4412 1124 D7F7.tmp 106 PID 4412 wrote to memory of 3316 4412 D8C2.tmp 107 PID 3316 wrote to memory of 1116 3316 D9BC.tmp 108 PID 1116 wrote to memory of 5332 1116 DA59.tmp 109 PID 5332 wrote to memory of 4364 5332 DB14.tmp 110 PID 4364 wrote to memory of 6000 4364 DBC0.tmp 111 PID 6000 wrote to memory of 1332 6000 DCAA.tmp 112 PID 1332 wrote to memory of 2104 1332 DD66.tmp 113 PID 2104 wrote to memory of 3496 2104 DE31.tmp 114 PID 3496 wrote to memory of 6020 3496 DEEC.tmp 115 PID 6020 wrote to memory of 4336 6020 DF89.tmp 116 PID 4336 wrote to memory of 5796 4336 E035.tmp 117 PID 5796 wrote to memory of 4008 5796 E10F.tmp 118 PID 4008 wrote to memory of 5456 4008 E1AC.tmp 119 PID 5456 wrote to memory of 4756 5456 E267.tmp 120 PID 4756 wrote to memory of 3164 4756 E332.tmp 121 PID 3164 wrote to memory of 948 3164 E3AF.tmp 122 PID 948 wrote to memory of 3500 948 E42C.tmp 123 PID 3500 wrote to memory of 3348 3500 E4C8.tmp 124 PID 3348 wrote to memory of 3564 3348 E555.tmp 125 PID 3564 wrote to memory of 1304 3564 E5D2.tmp 126 PID 1304 wrote to memory of 6100 1304 E66E.tmp 127 PID 6100 wrote to memory of 2132 6100 E70B.tmp 128 PID 2132 wrote to memory of 200 2132 E788.tmp 129 PID 200 wrote to memory of 1052 200 E833.tmp 130 PID 1052 wrote to memory of 1568 1052 E8C0.tmp 131 PID 1568 wrote to memory of 3568 1568 E94D.tmp 132 PID 3568 wrote to memory of 4604 3568 E9F9.tmp 133 PID 4604 wrote to memory of 4700 4604 EA95.tmp 134 PID 4700 wrote to memory of 2748 4700 EB02.tmp 135 PID 2748 wrote to memory of 2276 2748 EB7F.tmp 136 PID 2276 wrote to memory of 2172 2276 EC1B.tmp 137 PID 2172 wrote to memory of 3408 2172 EC98.tmp 138 PID 3408 wrote to memory of 4368 3408 ED25.tmp 139 PID 4368 wrote to memory of 4424 4368 EDC1.tmp 140 PID 4424 wrote to memory of 3844 4424 EE6D.tmp 141 PID 3844 wrote to memory of 1188 3844 EF19.tmp 142 PID 1188 wrote to memory of 3692 1188 EF86.tmp 143 PID 3692 wrote to memory of 4252 3692 F013.tmp 144 PID 4252 wrote to memory of 3836 4252 F0AF.tmp 145 PID 3836 wrote to memory of 3776 3836 F14C.tmp 146 PID 3776 wrote to memory of 932 3776 F1D8.tmp 147 PID 932 wrote to memory of 1184 932 F265.tmp 148 PID 1184 wrote to memory of 5324 1184 F2F1.tmp 149 PID 5324 wrote to memory of 1560 5324 F36E.tmp 150 PID 1560 wrote to memory of 3968 1560 F3FB.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_3407ee1dd419358515b89bb90041d366_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_3407ee1dd419358515b89bb90041d366_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\CC10.tmp"C:\Users\Admin\AppData\Local\Temp\CC10.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\CD78.tmp"C:\Users\Admin\AppData\Local\Temp\CD78.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\CE24.tmp"C:\Users\Admin\AppData\Local\Temp\CE24.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\CEC0.tmp"C:\Users\Admin\AppData\Local\Temp\CEC0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\D027.tmp"C:\Users\Admin\AppData\Local\Temp\D027.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\D19E.tmp"C:\Users\Admin\AppData\Local\Temp\D19E.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\D25A.tmp"C:\Users\Admin\AppData\Local\Temp\D25A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\D306.tmp"C:\Users\Admin\AppData\Local\Temp\D306.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\D46D.tmp"C:\Users\Admin\AppData\Local\Temp\D46D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\D538.tmp"C:\Users\Admin\AppData\Local\Temp\D538.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\D5D4.tmp"C:\Users\Admin\AppData\Local\Temp\D5D4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\D690.tmp"C:\Users\Admin\AppData\Local\Temp\D690.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\DA59.tmp"C:\Users\Admin\AppData\Local\Temp\DA59.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\DB14.tmp"C:\Users\Admin\AppData\Local\Temp\DB14.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\DD66.tmp"C:\Users\Admin\AppData\Local\Temp\DD66.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\DE31.tmp"C:\Users\Admin\AppData\Local\Temp\DE31.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\DEEC.tmp"C:\Users\Admin\AppData\Local\Temp\DEEC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\DF89.tmp"C:\Users\Admin\AppData\Local\Temp\DF89.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\E035.tmp"C:\Users\Admin\AppData\Local\Temp\E035.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\E10F.tmp"C:\Users\Admin\AppData\Local\Temp\E10F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\E267.tmp"C:\Users\Admin\AppData\Local\Temp\E267.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\E332.tmp"C:\Users\Admin\AppData\Local\Temp\E332.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\E42C.tmp"C:\Users\Admin\AppData\Local\Temp\E42C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\E555.tmp"C:\Users\Admin\AppData\Local\Temp\E555.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\E66E.tmp"C:\Users\Admin\AppData\Local\Temp\E66E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\E70B.tmp"C:\Users\Admin\AppData\Local\Temp\E70B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\E788.tmp"C:\Users\Admin\AppData\Local\Temp\E788.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\E833.tmp"C:\Users\Admin\AppData\Local\Temp\E833.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\E8C0.tmp"C:\Users\Admin\AppData\Local\Temp\E8C0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\E94D.tmp"C:\Users\Admin\AppData\Local\Temp\E94D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\EB02.tmp"C:\Users\Admin\AppData\Local\Temp\EB02.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\EC98.tmp"C:\Users\Admin\AppData\Local\Temp\EC98.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\ED25.tmp"C:\Users\Admin\AppData\Local\Temp\ED25.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\EDC1.tmp"C:\Users\Admin\AppData\Local\Temp\EDC1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\EF86.tmp"C:\Users\Admin\AppData\Local\Temp\EF86.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\F013.tmp"C:\Users\Admin\AppData\Local\Temp\F013.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\F14C.tmp"C:\Users\Admin\AppData\Local\Temp\F14C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\F265.tmp"C:\Users\Admin\AppData\Local\Temp\F265.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\F36E.tmp"C:\Users\Admin\AppData\Local\Temp\F36E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\F478.tmp"C:\Users\Admin\AppData\Local\Temp\F478.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"66⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"67⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"68⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\F68B.tmp"C:\Users\Admin\AppData\Local\Temp\F68B.tmp"69⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\F718.tmp"C:\Users\Admin\AppData\Local\Temp\F718.tmp"70⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\F870.tmp"C:\Users\Admin\AppData\Local\Temp\F870.tmp"72⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\F92B.tmp"C:\Users\Admin\AppData\Local\Temp\F92B.tmp"73⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"74⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\FA64.tmp"C:\Users\Admin\AppData\Local\Temp\FA64.tmp"75⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\FAD1.tmp"C:\Users\Admin\AppData\Local\Temp\FAD1.tmp"76⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"77⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"78⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\FC67.tmp"C:\Users\Admin\AppData\Local\Temp\FC67.tmp"79⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"80⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\FD71.tmp"C:\Users\Admin\AppData\Local\Temp\FD71.tmp"81⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"82⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"83⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"84⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"85⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"86⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\DC.tmp"C:\Users\Admin\AppData\Local\Temp\DC.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\188.tmp"C:\Users\Admin\AppData\Local\Temp\188.tmp"88⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\224.tmp"C:\Users\Admin\AppData\Local\Temp\224.tmp"89⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\2C0.tmp"C:\Users\Admin\AppData\Local\Temp\2C0.tmp"90⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\35D.tmp"C:\Users\Admin\AppData\Local\Temp\35D.tmp"91⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\3F9.tmp"C:\Users\Admin\AppData\Local\Temp\3F9.tmp"92⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\485.tmp"C:\Users\Admin\AppData\Local\Temp\485.tmp"93⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\512.tmp"C:\Users\Admin\AppData\Local\Temp\512.tmp"94⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\59F.tmp"C:\Users\Admin\AppData\Local\Temp\59F.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\61C.tmp"C:\Users\Admin\AppData\Local\Temp\61C.tmp"96⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\6A8.tmp"C:\Users\Admin\AppData\Local\Temp\6A8.tmp"97⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\745.tmp"C:\Users\Admin\AppData\Local\Temp\745.tmp"98⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\7C2.tmp"C:\Users\Admin\AppData\Local\Temp\7C2.tmp"99⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\83F.tmp"C:\Users\Admin\AppData\Local\Temp\83F.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\8BC.tmp"C:\Users\Admin\AppData\Local\Temp\8BC.tmp"101⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\967.tmp"C:\Users\Admin\AppData\Local\Temp\967.tmp"102⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\A23.tmp"C:\Users\Admin\AppData\Local\Temp\A23.tmp"103⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\ABF.tmp"C:\Users\Admin\AppData\Local\Temp\ABF.tmp"104⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\B4C.tmp"C:\Users\Admin\AppData\Local\Temp\B4C.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\BD8.tmp"C:\Users\Admin\AppData\Local\Temp\BD8.tmp"106⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\C36.tmp"C:\Users\Admin\AppData\Local\Temp\C36.tmp"107⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\CC3.tmp"C:\Users\Admin\AppData\Local\Temp\CC3.tmp"108⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\D40.tmp"C:\Users\Admin\AppData\Local\Temp\D40.tmp"109⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\DCC.tmp"C:\Users\Admin\AppData\Local\Temp\DCC.tmp"110⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\E49.tmp"C:\Users\Admin\AppData\Local\Temp\E49.tmp"111⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\EC6.tmp"C:\Users\Admin\AppData\Local\Temp\EC6.tmp"112⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\F43.tmp"C:\Users\Admin\AppData\Local\Temp\F43.tmp"113⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\FC0.tmp"C:\Users\Admin\AppData\Local\Temp\FC0.tmp"114⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\103D.tmp"C:\Users\Admin\AppData\Local\Temp\103D.tmp"115⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\10DA.tmp"C:\Users\Admin\AppData\Local\Temp\10DA.tmp"116⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"117⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\1212.tmp"C:\Users\Admin\AppData\Local\Temp\1212.tmp"118⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\129F.tmp"C:\Users\Admin\AppData\Local\Temp\129F.tmp"119⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"120⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\1399.tmp"C:\Users\Admin\AppData\Local\Temp\1399.tmp"121⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\1445.tmp"C:\Users\Admin\AppData\Local\Temp\1445.tmp"122⤵PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-