Analysis
- max time kernel
116s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_d719fcdaf82fdd1b05e5184b1b5247b1_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_d719fcdaf82fdd1b05e5184b1b5247b1_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-14_d719fcdaf82fdd1b05e5184b1b5247b1_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260814-2wntcatbrd
- SHA256 45bbb43008a0e0c1112cdce81fe26181922d95b468456b87c7acff05d264f5d9
- MD5 d719fcdaf82fdd1b05e5184b1b5247b1
- SHA1 09a62ebbb50287f7f4726cfae0c90a82f55ae450
- SHA512 29dc0fba26a2426552b295020e2ea84b496956be7a525f893837ea042f727aba942a2f57b2170476548b9118a8bd4a60729442a74d9b3b7f0df0503e447fa2ca
- SSDEEP 12288:wU5rCOTeiDUjUX4+GTOpJ54zTwOUYGPNZ+3/v+I9hUG2VA:wUQOJDuUIdiJ54zThUNPNGEA
- TLSH T176E4D02177D88532E5F7037859B5E6644DBEBD226722D6CF2F8021AE0AB1BD0D631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5920 76BD.tmp 464 7768.tmp 924 7814.tmp 4576 78EF.tmp 4580 798B.tmp 4312 7A56.tmp 3240 7B02.tmp 6040 7C3B.tmp 752 7D73.tmp 2564 7E10.tmp 2540 7EBB.tmp 3664 7F58.tmp 1040 8023.tmp 5660 80DE.tmp 5956 81A9.tmp 2528 8236.tmp 1552 82C3.tmp 4648 83BD.tmp 5132 843A.tmp 3576 84D6.tmp 2236 8582.tmp 4556 864D.tmp 1852 8737.tmp 2516 8802.tmp 2552 88ED.tmp 5312 895A.tmp 5256 8A06.tmp 5048 8AA2.tmp 2160 8B3F.tmp 3220 8BCB.tmp 1360 8C48.tmp 3680 8CC5.tmp 4292 8D61.tmp 2612 8DDE.tmp 4516 8E5B.tmp 1092 8EE8.tmp 6008 8F55.tmp 2728 8FD2.tmp 3084 904F.tmp 4360 90DC.tmp 1172 9169.tmp 4768 91F5.tmp 5480 9263.tmp 2088 92E0.tmp 5672 935D.tmp 2076 93F9.tmp 3076 9466.tmp 3400 94D4.tmp 3208 9541.tmp 840 95BE.tmp 5724 962B.tmp 1272 96A8.tmp 2576 9793.tmp 4528 9810.tmp 2884 987D.tmp 3568 9919.tmp 5172 9996.tmp 1660 9A13.tmp 2868 9A90.tmp 5932 9AFE.tmp 1368 9B6B.tmp 2368 9BD9.tmp 4600 9C36.tmp 4904 9CA4.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1960.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D046.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 347F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B69F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1723.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 376D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A74D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A970.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E437.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 278E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EBB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1892 wrote to memory of 5920 1892 2026-08-14_d719fcdaf82fdd1b05e5184b1b5247b1_elex_mafia_stealc_tofsee.exe 89 PID 5920 wrote to memory of 464 5920 76BD.tmp 90 PID 464 wrote to memory of 924 464 7768.tmp 91 PID 924 wrote to memory of 4576 924 7814.tmp 92 PID 4576 wrote to memory of 4580 4576 78EF.tmp 93 PID 4580 wrote to memory of 4312 4580 798B.tmp 94 PID 4312 wrote to memory of 3240 4312 7A56.tmp 95 PID 3240 wrote to memory of 6040 3240 7B02.tmp 96 PID 6040 wrote to memory of 752 6040 7C3B.tmp 97 PID 752 wrote to memory of 2564 752 7D73.tmp 98 PID 2564 wrote to memory of 2540 2564 7E10.tmp 99 PID 2540 wrote to memory of 3664 2540 7EBB.tmp 100 PID 3664 wrote to memory of 1040 3664 7F58.tmp 101 PID 1040 wrote to memory of 5660 1040 8023.tmp 102 PID 5660 wrote to memory of 5956 5660 80DE.tmp 103 PID 5956 wrote to memory of 2528 5956 81A9.tmp 104 PID 2528 wrote to memory of 1552 2528 8236.tmp 105 PID 1552 wrote to memory of 4648 1552 82C3.tmp 106 PID 4648 wrote to memory of 5132 4648 83BD.tmp 107 PID 5132 wrote to memory of 3576 5132 843A.tmp 108 PID 3576 wrote to memory of 2236 3576 84D6.tmp 109 PID 2236 wrote to memory of 4556 2236 8582.tmp 110 PID 4556 wrote to memory of 1852 4556 864D.tmp 111 PID 1852 wrote to memory of 2516 1852 8737.tmp 112 PID 2516 wrote to memory of 2552 2516 8802.tmp 113 PID 2552 wrote to memory of 5312 2552 88ED.tmp 114 PID 5312 wrote to memory of 5256 5312 895A.tmp 115 PID 5256 wrote to memory of 5048 5256 8A06.tmp 116 PID 5048 wrote to memory of 2160 5048 8AA2.tmp 117 PID 2160 wrote to memory of 3220 2160 8B3F.tmp 118 PID 3220 wrote to memory of 1360 3220 8BCB.tmp 119 PID 1360 wrote to memory of 3680 1360 8C48.tmp 120 PID 3680 wrote to memory of 4292 3680 8CC5.tmp 121 PID 4292 wrote to memory of 2612 4292 8D61.tmp 122 PID 2612 wrote to memory of 4516 2612 8DDE.tmp 123 PID 4516 wrote to memory of 1092 4516 8E5B.tmp 124 PID 1092 wrote to memory of 6008 1092 8EE8.tmp 125 PID 6008 wrote to memory of 2728 6008 8F55.tmp 126 PID 2728 wrote to memory of 3084 2728 8FD2.tmp 127 PID 3084 wrote to memory of 4360 3084 904F.tmp 128 PID 4360 wrote to memory of 1172 4360 90DC.tmp 129 PID 1172 wrote to memory of 4768 1172 9169.tmp 130 PID 4768 wrote to memory of 5480 4768 91F5.tmp 131 PID 5480 wrote to memory of 2088 5480 9263.tmp 132 PID 2088 wrote to memory of 5672 2088 92E0.tmp 133 PID 5672 wrote to memory of 2076 5672 935D.tmp 134 PID 2076 wrote to memory of 3076 2076 93F9.tmp 135 PID 3076 wrote to memory of 3400 3076 9466.tmp 136 PID 3400 wrote to memory of 3208 3400 94D4.tmp 137 PID 3208 wrote to memory of 840 3208 9541.tmp 138 PID 840 wrote to memory of 5724 840 95BE.tmp 139 PID 5724 wrote to memory of 1272 5724 962B.tmp 140 PID 3896 wrote to memory of 2576 3896 9725.tmp 142 PID 2576 wrote to memory of 4528 2576 9793.tmp 143 PID 4528 wrote to memory of 2884 4528 9810.tmp 144 PID 2884 wrote to memory of 3568 2884 987D.tmp 145 PID 3568 wrote to memory of 5172 3568 9919.tmp 146 PID 5172 wrote to memory of 1660 5172 9996.tmp 147 PID 1660 wrote to memory of 2868 1660 9A13.tmp 148 PID 2868 wrote to memory of 5932 2868 9A90.tmp 149 PID 5932 wrote to memory of 1368 5932 9AFE.tmp 150 PID 1368 wrote to memory of 2368 1368 9B6B.tmp 151 PID 2368 wrote to memory of 4600 2368 9BD9.tmp 152 PID 4600 wrote to memory of 4904 4600 9C36.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_d719fcdaf82fdd1b05e5184b1b5247b1_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_d719fcdaf82fdd1b05e5184b1b5247b1_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\76BD.tmp"C:\Users\Admin\AppData\Local\Temp\76BD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\7768.tmp"C:\Users\Admin\AppData\Local\Temp\7768.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\7814.tmp"C:\Users\Admin\AppData\Local\Temp\7814.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\78EF.tmp"C:\Users\Admin\AppData\Local\Temp\78EF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\798B.tmp"C:\Users\Admin\AppData\Local\Temp\798B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\7A56.tmp"C:\Users\Admin\AppData\Local\Temp\7A56.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\7B02.tmp"C:\Users\Admin\AppData\Local\Temp\7B02.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\7D73.tmp"C:\Users\Admin\AppData\Local\Temp\7D73.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\7E10.tmp"C:\Users\Admin\AppData\Local\Temp\7E10.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\7EBB.tmp"C:\Users\Admin\AppData\Local\Temp\7EBB.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\7F58.tmp"C:\Users\Admin\AppData\Local\Temp\7F58.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\8023.tmp"C:\Users\Admin\AppData\Local\Temp\8023.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\80DE.tmp"C:\Users\Admin\AppData\Local\Temp\80DE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\8236.tmp"C:\Users\Admin\AppData\Local\Temp\8236.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\82C3.tmp"C:\Users\Admin\AppData\Local\Temp\82C3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\83BD.tmp"C:\Users\Admin\AppData\Local\Temp\83BD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\843A.tmp"C:\Users\Admin\AppData\Local\Temp\843A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\84D6.tmp"C:\Users\Admin\AppData\Local\Temp\84D6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\8582.tmp"C:\Users\Admin\AppData\Local\Temp\8582.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\864D.tmp"C:\Users\Admin\AppData\Local\Temp\864D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\8737.tmp"C:\Users\Admin\AppData\Local\Temp\8737.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\8802.tmp"C:\Users\Admin\AppData\Local\Temp\8802.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\895A.tmp"C:\Users\Admin\AppData\Local\Temp\895A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\8A06.tmp"C:\Users\Admin\AppData\Local\Temp\8A06.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\904F.tmp"C:\Users\Admin\AppData\Local\Temp\904F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\90DC.tmp"C:\Users\Admin\AppData\Local\Temp\90DC.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\9169.tmp"C:\Users\Admin\AppData\Local\Temp\9169.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\91F5.tmp"C:\Users\Admin\AppData\Local\Temp\91F5.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9263.tmp"C:\Users\Admin\AppData\Local\Temp\9263.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\92E0.tmp"C:\Users\Admin\AppData\Local\Temp\92E0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\935D.tmp"C:\Users\Admin\AppData\Local\Temp\935D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\93F9.tmp"C:\Users\Admin\AppData\Local\Temp\93F9.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\9466.tmp"C:\Users\Admin\AppData\Local\Temp\9466.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\94D4.tmp"C:\Users\Admin\AppData\Local\Temp\94D4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\9541.tmp"C:\Users\Admin\AppData\Local\Temp\9541.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\96A8.tmp"C:\Users\Admin\AppData\Local\Temp\96A8.tmp"53⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\9725.tmp"C:\Users\Admin\AppData\Local\Temp\9725.tmp"54⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\9810.tmp"C:\Users\Admin\AppData\Local\Temp\9810.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\987D.tmp"C:\Users\Admin\AppData\Local\Temp\987D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\9919.tmp"C:\Users\Admin\AppData\Local\Temp\9919.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\9996.tmp"C:\Users\Admin\AppData\Local\Temp\9996.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\9A13.tmp"C:\Users\Admin\AppData\Local\Temp\9A13.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\9A90.tmp"C:\Users\Admin\AppData\Local\Temp\9A90.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\9AFE.tmp"C:\Users\Admin\AppData\Local\Temp\9AFE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\9C36.tmp"C:\Users\Admin\AppData\Local\Temp\9C36.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"66⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\9D11.tmp"C:\Users\Admin\AppData\Local\Temp\9D11.tmp"67⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"68⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"69⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\9E88.tmp"C:\Users\Admin\AppData\Local\Temp\9E88.tmp"70⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"71⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\9F72.tmp"C:\Users\Admin\AppData\Local\Temp\9F72.tmp"72⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\A06C.tmp"C:\Users\Admin\AppData\Local\Temp\A06C.tmp"74⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"75⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\A157.tmp"C:\Users\Admin\AppData\Local\Temp\A157.tmp"76⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"77⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\A251.tmp"C:\Users\Admin\AppData\Local\Temp\A251.tmp"78⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"79⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\A32C.tmp"C:\Users\Admin\AppData\Local\Temp\A32C.tmp"80⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\A399.tmp"C:\Users\Admin\AppData\Local\Temp\A399.tmp"81⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\A406.tmp"C:\Users\Admin\AppData\Local\Temp\A406.tmp"82⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\A474.tmp"C:\Users\Admin\AppData\Local\Temp\A474.tmp"83⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\A4D1.tmp"C:\Users\Admin\AppData\Local\Temp\A4D1.tmp"84⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\A52F.tmp"C:\Users\Admin\AppData\Local\Temp\A52F.tmp"85⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\A59D.tmp"C:\Users\Admin\AppData\Local\Temp\A59D.tmp"86⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"87⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"88⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\A6C5.tmp"C:\Users\Admin\AppData\Local\Temp\A6C5.tmp"89⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\A742.tmp"C:\Users\Admin\AppData\Local\Temp\A742.tmp"90⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"91⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\A82D.tmp"C:\Users\Admin\AppData\Local\Temp\A82D.tmp"92⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\A89A.tmp"C:\Users\Admin\AppData\Local\Temp\A89A.tmp"93⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"94⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\A956.tmp"C:\Users\Admin\AppData\Local\Temp\A956.tmp"95⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\AA21.tmp"C:\Users\Admin\AppData\Local\Temp\AA21.tmp"97⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"98⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"99⤵PID:52
-
C:\Users\Admin\AppData\Local\Temp\AB59.tmp"C:\Users\Admin\AppData\Local\Temp\AB59.tmp"100⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"101⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\AC15.tmp"C:\Users\Admin\AppData\Local\Temp\AC15.tmp"102⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\AC73.tmp"C:\Users\Admin\AppData\Local\Temp\AC73.tmp"103⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\ACC1.tmp"C:\Users\Admin\AppData\Local\Temp\ACC1.tmp"104⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\AD7C.tmp"C:\Users\Admin\AppData\Local\Temp\AD7C.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\ADEA.tmp"C:\Users\Admin\AppData\Local\Temp\ADEA.tmp"107⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\AE47.tmp"C:\Users\Admin\AppData\Local\Temp\AE47.tmp"108⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"109⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\AF12.tmp"C:\Users\Admin\AppData\Local\Temp\AF12.tmp"110⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"111⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"112⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\B089.tmp"C:\Users\Admin\AppData\Local\Temp\B089.tmp"113⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\B116.tmp"C:\Users\Admin\AppData\Local\Temp\B116.tmp"114⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"115⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"116⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"117⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\B368.tmp"C:\Users\Admin\AppData\Local\Temp\B368.tmp"118⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\B414.tmp"C:\Users\Admin\AppData\Local\Temp\B414.tmp"119⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\B491.tmp"C:\Users\Admin\AppData\Local\Temp\B491.tmp"120⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\B55C.tmp"C:\Users\Admin\AppData\Local\Temp\B55C.tmp"121⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\B608.tmp"C:\Users\Admin\AppData\Local\Temp\B608.tmp"122⤵PID:2040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-