Analysis
- max time kernel
123s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 22:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_8485c4215df1d471d3e2d8a5404adab9_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_8485c4215df1d471d3e2d8a5404adab9_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-13_8485c4215df1d471d3e2d8a5404adab9_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260813-2f212adg64
- SHA256 bea96e15d432cd6b798cec0c16c87ae8b15f4e3ca49a5ce7cfe67d8f813e5ad4
- MD5 8485c4215df1d471d3e2d8a5404adab9
- SHA1 9267904826597c756bc8f6d8e0df4681fdf02212
- SHA512 5cd5f47e7602733e22c4c171379af0758ef91f55f8eba2d4c0f95e920684ef07b154a6273a8e461ba5a2b4cda00bc1b3b40624e2edeb99951cf73860acb2fd93
- SSDEEP 12288:NU5rCOTeijGsyDMQ0Fo7FAa+2mhlp6xxJoxa67TZwlH4Hp:NUQOJjfrF0Aa+2zx7ovTSlH4Hp
- TLSH T16AB4E1267285C133E6D302310ADAEBA26A3B7C75572694C72794A63E2F713E1D379307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2580 B7C2.tmp 4968 B88D.tmp 5816 B929.tmp 852 B9E5.tmp 1924 BAA0.tmp 2604 BB7B.tmp 2408 BC56.tmp 2492 BD11.tmp 6020 BDBD.tmp 4524 BF25.tmp 2856 C04D.tmp 5636 C0F9.tmp 2700 C1C4.tmp 4740 C251.tmp 3020 C34B.tmp 5740 C416.tmp 5708 C4F1.tmp 6064 C58D.tmp 240 C61A.tmp 4100 C704.tmp 4808 C7EF.tmp 2744 C88B.tmp 1968 C966.tmp 3228 CA31.tmp 5632 CAFC.tmp 1376 CBD7.tmp 4064 CC82.tmp 2252 CD7C.tmp 5336 CE09.tmp 420 CEA5.tmp 1604 CF42.tmp 984 CFCE.tmp 5792 D099.tmp 1436 D136.tmp 2756 D1B3.tmp 5252 D23F.tmp 6044 D2CC.tmp 2964 D368.tmp 5204 D3F5.tmp 2564 D491.tmp 2684 D51E.tmp 4936 D59B.tmp 1752 D646.tmp 5136 D6E3.tmp 2960 D76F.tmp 552 D7FC.tmp 1060 D889.tmp 4520 D915.tmp 2012 D9B1.tmp 3008 DA7D.tmp 4420 DAFA.tmp 3420 DB96.tmp 4348 DC22.tmp 4792 DC90.tmp 1824 DD1C.tmp 4232 DDB9.tmp 5780 DE26.tmp 4424 DEC2.tmp 4196 DF30.tmp 5716 DFCC.tmp 1804 E049.tmp 1460 E0C6.tmp 4604 E153.tmp 4160 E1EF.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D889.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E625.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F65C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C411.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ED9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D23F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5990.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4332 wrote to memory of 2580 4332 2026-08-13_8485c4215df1d471d3e2d8a5404adab9_elex_mafia_stealc_tofsee.exe 88 PID 2580 wrote to memory of 4968 2580 B7C2.tmp 89 PID 4968 wrote to memory of 5816 4968 B88D.tmp 91 PID 5816 wrote to memory of 852 5816 B929.tmp 92 PID 852 wrote to memory of 1924 852 B9E5.tmp 93 PID 1924 wrote to memory of 2604 1924 BAA0.tmp 94 PID 2604 wrote to memory of 2408 2604 BB7B.tmp 95 PID 2408 wrote to memory of 2492 2408 BC56.tmp 96 PID 2492 wrote to memory of 6020 2492 BD11.tmp 97 PID 6020 wrote to memory of 4524 6020 BDBD.tmp 98 PID 4524 wrote to memory of 2856 4524 BF25.tmp 99 PID 2856 wrote to memory of 5636 2856 C04D.tmp 100 PID 5636 wrote to memory of 2700 5636 C0F9.tmp 101 PID 2700 wrote to memory of 4740 2700 C1C4.tmp 102 PID 4740 wrote to memory of 3020 4740 C251.tmp 103 PID 3020 wrote to memory of 5740 3020 C34B.tmp 104 PID 5740 wrote to memory of 5708 5740 C416.tmp 105 PID 5708 wrote to memory of 6064 5708 C4F1.tmp 106 PID 6064 wrote to memory of 240 6064 C58D.tmp 107 PID 240 wrote to memory of 4100 240 C61A.tmp 108 PID 4100 wrote to memory of 4808 4100 C704.tmp 109 PID 4808 wrote to memory of 2744 4808 C7EF.tmp 110 PID 2744 wrote to memory of 1968 2744 C88B.tmp 111 PID 1968 wrote to memory of 3228 1968 C966.tmp 112 PID 3228 wrote to memory of 5632 3228 CA31.tmp 113 PID 5632 wrote to memory of 1376 5632 CAFC.tmp 114 PID 1376 wrote to memory of 4064 1376 CBD7.tmp 115 PID 4064 wrote to memory of 2252 4064 CC82.tmp 116 PID 2252 wrote to memory of 5336 2252 CD7C.tmp 117 PID 5336 wrote to memory of 420 5336 CE09.tmp 118 PID 420 wrote to memory of 1604 420 CEA5.tmp 119 PID 1604 wrote to memory of 984 1604 CF42.tmp 120 PID 984 wrote to memory of 5792 984 CFCE.tmp 121 PID 5792 wrote to memory of 1436 5792 D099.tmp 122 PID 1436 wrote to memory of 2756 1436 D136.tmp 123 PID 2756 wrote to memory of 5252 2756 D1B3.tmp 124 PID 5252 wrote to memory of 6044 5252 D23F.tmp 125 PID 6044 wrote to memory of 2964 6044 D2CC.tmp 126 PID 2964 wrote to memory of 5204 2964 D368.tmp 127 PID 5204 wrote to memory of 2564 5204 D3F5.tmp 128 PID 2564 wrote to memory of 2684 2564 D491.tmp 129 PID 2684 wrote to memory of 4936 2684 D51E.tmp 130 PID 4936 wrote to memory of 1752 4936 D59B.tmp 131 PID 1752 wrote to memory of 5136 1752 D646.tmp 132 PID 5136 wrote to memory of 2960 5136 D6E3.tmp 133 PID 2960 wrote to memory of 552 2960 D76F.tmp 134 PID 552 wrote to memory of 1060 552 D7FC.tmp 135 PID 1060 wrote to memory of 4520 1060 D889.tmp 136 PID 4520 wrote to memory of 2012 4520 D915.tmp 137 PID 2012 wrote to memory of 3008 2012 D9B1.tmp 138 PID 3008 wrote to memory of 4420 3008 DA7D.tmp 139 PID 4420 wrote to memory of 3420 4420 DAFA.tmp 140 PID 3420 wrote to memory of 4348 3420 DB96.tmp 141 PID 4348 wrote to memory of 4792 4348 DC22.tmp 142 PID 4792 wrote to memory of 1824 4792 DC90.tmp 143 PID 1824 wrote to memory of 4232 1824 DD1C.tmp 144 PID 4232 wrote to memory of 5780 4232 DDB9.tmp 145 PID 5780 wrote to memory of 4424 5780 DE26.tmp 146 PID 4424 wrote to memory of 4196 4424 DEC2.tmp 147 PID 4196 wrote to memory of 5716 4196 DF30.tmp 148 PID 5716 wrote to memory of 1804 5716 DFCC.tmp 149 PID 1804 wrote to memory of 1460 1804 E049.tmp 150 PID 1460 wrote to memory of 4604 1460 E0C6.tmp 151 PID 4604 wrote to memory of 4160 4604 E153.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_8485c4215df1d471d3e2d8a5404adab9_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_8485c4215df1d471d3e2d8a5404adab9_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\B88D.tmp"C:\Users\Admin\AppData\Local\Temp\B88D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\B929.tmp"C:\Users\Admin\AppData\Local\Temp\B929.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\BC56.tmp"C:\Users\Admin\AppData\Local\Temp\BC56.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\BD11.tmp"C:\Users\Admin\AppData\Local\Temp\BD11.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\BF25.tmp"C:\Users\Admin\AppData\Local\Temp\BF25.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\C04D.tmp"C:\Users\Admin\AppData\Local\Temp\C04D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\C0F9.tmp"C:\Users\Admin\AppData\Local\Temp\C0F9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\C251.tmp"C:\Users\Admin\AppData\Local\Temp\C251.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\C34B.tmp"C:\Users\Admin\AppData\Local\Temp\C34B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\C58D.tmp"C:\Users\Admin\AppData\Local\Temp\C58D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\C61A.tmp"C:\Users\Admin\AppData\Local\Temp\C61A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\C704.tmp"C:\Users\Admin\AppData\Local\Temp\C704.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\C7EF.tmp"C:\Users\Admin\AppData\Local\Temp\C7EF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\C88B.tmp"C:\Users\Admin\AppData\Local\Temp\C88B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\C966.tmp"C:\Users\Admin\AppData\Local\Temp\C966.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\CA31.tmp"C:\Users\Admin\AppData\Local\Temp\CA31.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\CC82.tmp"C:\Users\Admin\AppData\Local\Temp\CC82.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\CF42.tmp"C:\Users\Admin\AppData\Local\Temp\CF42.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\D136.tmp"C:\Users\Admin\AppData\Local\Temp\D136.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\D23F.tmp"C:\Users\Admin\AppData\Local\Temp\D23F.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\D368.tmp"C:\Users\Admin\AppData\Local\Temp\D368.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\D491.tmp"C:\Users\Admin\AppData\Local\Temp\D491.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\D646.tmp"C:\Users\Admin\AppData\Local\Temp\D646.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\D6E3.tmp"C:\Users\Admin\AppData\Local\Temp\D6E3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\D7FC.tmp"C:\Users\Admin\AppData\Local\Temp\D7FC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\D915.tmp"C:\Users\Admin\AppData\Local\Temp\D915.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\DB96.tmp"C:\Users\Admin\AppData\Local\Temp\DB96.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\DC22.tmp"C:\Users\Admin\AppData\Local\Temp\DC22.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\DC90.tmp"C:\Users\Admin\AppData\Local\Temp\DC90.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\DE26.tmp"C:\Users\Admin\AppData\Local\Temp\DE26.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\DF30.tmp"C:\Users\Admin\AppData\Local\Temp\DF30.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\E049.tmp"C:\Users\Admin\AppData\Local\Temp\E049.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\E153.tmp"C:\Users\Admin\AppData\Local\Temp\E153.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"65⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\E27B.tmp"C:\Users\Admin\AppData\Local\Temp\E27B.tmp"66⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\E327.tmp"C:\Users\Admin\AppData\Local\Temp\E327.tmp"67⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\E3C4.tmp"C:\Users\Admin\AppData\Local\Temp\E3C4.tmp"68⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\E460.tmp"C:\Users\Admin\AppData\Local\Temp\E460.tmp"69⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\E50C.tmp"C:\Users\Admin\AppData\Local\Temp\E50C.tmp"70⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"71⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\E625.tmp"C:\Users\Admin\AppData\Local\Temp\E625.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"73⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\E72F.tmp"C:\Users\Admin\AppData\Local\Temp\E72F.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"75⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\E877.tmp"C:\Users\Admin\AppData\Local\Temp\E877.tmp"76⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\E903.tmp"C:\Users\Admin\AppData\Local\Temp\E903.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\E990.tmp"C:\Users\Admin\AppData\Local\Temp\E990.tmp"78⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"79⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"80⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\EB26.tmp"C:\Users\Admin\AppData\Local\Temp\EB26.tmp"81⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"82⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\EC30.tmp"C:\Users\Admin\AppData\Local\Temp\EC30.tmp"83⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\ECCC.tmp"C:\Users\Admin\AppData\Local\Temp\ECCC.tmp"84⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\ED68.tmp"C:\Users\Admin\AppData\Local\Temp\ED68.tmp"85⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"86⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\EE72.tmp"C:\Users\Admin\AppData\Local\Temp\EE72.tmp"87⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"88⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"89⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\F018.tmp"C:\Users\Admin\AppData\Local\Temp\F018.tmp"90⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"91⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\F141.tmp"C:\Users\Admin\AppData\Local\Temp\F141.tmp"92⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"93⤵PID:52
-
C:\Users\Admin\AppData\Local\Temp\F25A.tmp"C:\Users\Admin\AppData\Local\Temp\F25A.tmp"94⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"95⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\F364.tmp"C:\Users\Admin\AppData\Local\Temp\F364.tmp"96⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"97⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\F48C.tmp"C:\Users\Admin\AppData\Local\Temp\F48C.tmp"98⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\F519.tmp"C:\Users\Admin\AppData\Local\Temp\F519.tmp"99⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\F5A6.tmp"C:\Users\Admin\AppData\Local\Temp\F5A6.tmp"100⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\F632.tmp"C:\Users\Admin\AppData\Local\Temp\F632.tmp"101⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\F6DE.tmp"C:\Users\Admin\AppData\Local\Temp\F6DE.tmp"102⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\F74C.tmp"C:\Users\Admin\AppData\Local\Temp\F74C.tmp"103⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\F7D8.tmp"C:\Users\Admin\AppData\Local\Temp\F7D8.tmp"104⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\F855.tmp"C:\Users\Admin\AppData\Local\Temp\F855.tmp"105⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"106⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\F95F.tmp"C:\Users\Admin\AppData\Local\Temp\F95F.tmp"107⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\F9EB.tmp"C:\Users\Admin\AppData\Local\Temp\F9EB.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\FA68.tmp"C:\Users\Admin\AppData\Local\Temp\FA68.tmp"109⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\FB72.tmp"C:\Users\Admin\AppData\Local\Temp\FB72.tmp"111⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\FBEF.tmp"C:\Users\Admin\AppData\Local\Temp\FBEF.tmp"112⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"113⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\FD08.tmp"C:\Users\Admin\AppData\Local\Temp\FD08.tmp"114⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\FD95.tmp"C:\Users\Admin\AppData\Local\Temp\FD95.tmp"115⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\FE31.tmp"C:\Users\Admin\AppData\Local\Temp\FE31.tmp"116⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\FEBE.tmp"C:\Users\Admin\AppData\Local\Temp\FEBE.tmp"117⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"118⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"119⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\64.tmp"C:\Users\Admin\AppData\Local\Temp\64.tmp"120⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\110.tmp"C:\Users\Admin\AppData\Local\Temp\110.tmp"121⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\18D.tmp"C:\Users\Admin\AppData\Local\Temp\18D.tmp"122⤵PID:4468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-