Analysis
- max time kernel
130s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 23:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_e0f0152ecd243ba8e4dff73be3e7be8f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_e0f0152ecd243ba8e4dff73be3e7be8f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-19_e0f0152ecd243ba8e4dff73be3e7be8f_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260819-3sgfjaac64
- SHA256 19e543f45295b5d02d612028400029d9978b220d8b079bb86e23e2ff0d4ec767
- MD5 e0f0152ecd243ba8e4dff73be3e7be8f
- SHA1 5b87b79af84009ebb3a01bb7cf917222f2625afa
- SHA512 edc17268a15d09b6e5492fdfab34a7b10dbcb4c1fff0e1c6e69235c5c4b27ca0d69b2038356041f9ee87771ef3be6454a650d6e1f0349c4a5b8370531f37d56d
- SSDEEP 12288:NU5rCOTeijcEij0pFZXcH6PPirHqdUjEco2TZwlH:NUQOJjcjAFtcH8qrHqdFz2TSlH
- TLSH T1C7B4E125B685C132E29212310AD6EBB2693FBD765736A4C33B84636E2FB53D1D335306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5040 798B.tmp 5196 7A66.tmp 4120 7B31.tmp 4504 7BFC.tmp 2964 7C79.tmp 3240 7D35.tmp 3344 7DD1.tmp 5324 7E9C.tmp 2524 7F77.tmp 4776 8042.tmp 1240 80CF.tmp 1504 818A.tmp 3564 8217.tmp 5256 82B3.tmp 2424 8340.tmp 3924 83CC.tmp 3840 8478.tmp 3816 8543.tmp 3236 85E0.tmp 2908 869B.tmp 2316 8766.tmp 1268 8841.tmp 3724 88ED.tmp 1116 89B8.tmp 1680 8A93.tmp 5448 8B1F.tmp 4440 8BBC.tmp 4108 8C48.tmp 3464 8D23.tmp 2268 8DB0.tmp 1544 8E7B.tmp 4800 8F27.tmp 3772 8FC3.tmp 4124 9040.tmp 3668 90AD.tmp 3416 911B.tmp 5116 9198.tmp 5360 9205.tmp 4236 9282.tmp 3664 930F.tmp 2780 93AB.tmp 712 9418.tmp 5016 94A5.tmp 3400 9512.tmp 4580 959F.tmp 3616 960C.tmp 4324 9689.tmp 2264 9706.tmp 720 9783.tmp 4244 981F.tmp 1836 989C.tmp 4892 9939.tmp 2472 99B6.tmp 4900 9A42.tmp 924 9ADF.tmp 5592 9B6B.tmp 4460 9BF8.tmp 4100 9CB3.tmp 1432 9D21.tmp 2468 9DAD.tmp 592 9E2A.tmp 1356 9EC7.tmp 3252 9F34.tmp 4768 9FC1.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1336.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B349.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 761C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9396.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 732E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 226E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2259.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 393D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6245.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9636.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 680D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 243E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1280.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 352B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2397.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB81.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4200 wrote to memory of 5040 4200 2026-08-19_e0f0152ecd243ba8e4dff73be3e7be8f_elex_mafia_stealc_tofsee.exe 89 PID 5040 wrote to memory of 5196 5040 798B.tmp 90 PID 5196 wrote to memory of 4120 5196 7A66.tmp 91 PID 4120 wrote to memory of 4504 4120 7B31.tmp 92 PID 4504 wrote to memory of 2964 4504 7BFC.tmp 93 PID 2964 wrote to memory of 3240 2964 7C79.tmp 94 PID 3240 wrote to memory of 3344 3240 7D35.tmp 95 PID 3344 wrote to memory of 5324 3344 7DD1.tmp 96 PID 5324 wrote to memory of 2524 5324 7E9C.tmp 97 PID 2524 wrote to memory of 4776 2524 7F77.tmp 98 PID 4776 wrote to memory of 1240 4776 8042.tmp 99 PID 1240 wrote to memory of 1504 1240 80CF.tmp 100 PID 1504 wrote to memory of 3564 1504 818A.tmp 101 PID 3564 wrote to memory of 5256 3564 8217.tmp 102 PID 5256 wrote to memory of 2424 5256 82B3.tmp 103 PID 2424 wrote to memory of 3924 2424 8340.tmp 104 PID 3924 wrote to memory of 3840 3924 83CC.tmp 105 PID 3840 wrote to memory of 3816 3840 8478.tmp 106 PID 3816 wrote to memory of 3236 3816 8543.tmp 107 PID 3236 wrote to memory of 2908 3236 85E0.tmp 108 PID 2908 wrote to memory of 2316 2908 869B.tmp 109 PID 2316 wrote to memory of 1268 2316 8766.tmp 110 PID 1268 wrote to memory of 3724 1268 8841.tmp 111 PID 3724 wrote to memory of 1116 3724 88ED.tmp 112 PID 1116 wrote to memory of 1680 1116 89B8.tmp 113 PID 1680 wrote to memory of 5448 1680 8A93.tmp 114 PID 5448 wrote to memory of 4440 5448 8B1F.tmp 115 PID 4440 wrote to memory of 4108 4440 8BBC.tmp 116 PID 4108 wrote to memory of 3464 4108 8C48.tmp 117 PID 3464 wrote to memory of 2268 3464 8D23.tmp 118 PID 2268 wrote to memory of 1544 2268 8DB0.tmp 119 PID 1544 wrote to memory of 4800 1544 8E7B.tmp 120 PID 4800 wrote to memory of 3772 4800 8F27.tmp 121 PID 3772 wrote to memory of 4124 3772 8FC3.tmp 122 PID 4124 wrote to memory of 3668 4124 9040.tmp 123 PID 3668 wrote to memory of 3416 3668 90AD.tmp 124 PID 3416 wrote to memory of 5116 3416 911B.tmp 125 PID 5116 wrote to memory of 5360 5116 9198.tmp 126 PID 5360 wrote to memory of 4236 5360 9205.tmp 127 PID 4236 wrote to memory of 3664 4236 9282.tmp 128 PID 3664 wrote to memory of 2780 3664 930F.tmp 129 PID 2780 wrote to memory of 712 2780 93AB.tmp 130 PID 712 wrote to memory of 5016 712 9418.tmp 131 PID 5016 wrote to memory of 3400 5016 94A5.tmp 132 PID 3400 wrote to memory of 4580 3400 9512.tmp 133 PID 4580 wrote to memory of 3616 4580 959F.tmp 134 PID 3616 wrote to memory of 4324 3616 960C.tmp 135 PID 4324 wrote to memory of 2264 4324 9689.tmp 136 PID 2264 wrote to memory of 720 2264 9706.tmp 137 PID 720 wrote to memory of 4244 720 9783.tmp 138 PID 4244 wrote to memory of 1836 4244 981F.tmp 139 PID 1836 wrote to memory of 4892 1836 989C.tmp 140 PID 4892 wrote to memory of 2472 4892 9939.tmp 141 PID 2472 wrote to memory of 4900 2472 99B6.tmp 142 PID 4900 wrote to memory of 924 4900 9A42.tmp 143 PID 924 wrote to memory of 5592 924 9ADF.tmp 144 PID 5592 wrote to memory of 4460 5592 9B6B.tmp 145 PID 4460 wrote to memory of 4100 4460 9BF8.tmp 146 PID 4100 wrote to memory of 1432 4100 9CB3.tmp 147 PID 1432 wrote to memory of 2468 1432 9D21.tmp 148 PID 2468 wrote to memory of 592 2468 9DAD.tmp 149 PID 592 wrote to memory of 1356 592 9E2A.tmp 150 PID 1356 wrote to memory of 3252 1356 9EC7.tmp 151 PID 3252 wrote to memory of 4768 3252 9F34.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_e0f0152ecd243ba8e4dff73be3e7be8f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_e0f0152ecd243ba8e4dff73be3e7be8f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\798B.tmp"C:\Users\Admin\AppData\Local\Temp\798B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\7A66.tmp"C:\Users\Admin\AppData\Local\Temp\7A66.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\7B31.tmp"C:\Users\Admin\AppData\Local\Temp\7B31.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\7C79.tmp"C:\Users\Admin\AppData\Local\Temp\7C79.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\7D35.tmp"C:\Users\Admin\AppData\Local\Temp\7D35.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\7F77.tmp"C:\Users\Admin\AppData\Local\Temp\7F77.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\8042.tmp"C:\Users\Admin\AppData\Local\Temp\8042.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\80CF.tmp"C:\Users\Admin\AppData\Local\Temp\80CF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\818A.tmp"C:\Users\Admin\AppData\Local\Temp\818A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\8217.tmp"C:\Users\Admin\AppData\Local\Temp\8217.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\82B3.tmp"C:\Users\Admin\AppData\Local\Temp\82B3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\8340.tmp"C:\Users\Admin\AppData\Local\Temp\8340.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\83CC.tmp"C:\Users\Admin\AppData\Local\Temp\83CC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\8478.tmp"C:\Users\Admin\AppData\Local\Temp\8478.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\85E0.tmp"C:\Users\Admin\AppData\Local\Temp\85E0.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\869B.tmp"C:\Users\Admin\AppData\Local\Temp\869B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\8766.tmp"C:\Users\Admin\AppData\Local\Temp\8766.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\8841.tmp"C:\Users\Admin\AppData\Local\Temp\8841.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\89B8.tmp"C:\Users\Admin\AppData\Local\Temp\89B8.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\8B1F.tmp"C:\Users\Admin\AppData\Local\Temp\8B1F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\8DB0.tmp"C:\Users\Admin\AppData\Local\Temp\8DB0.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\9040.tmp"C:\Users\Admin\AppData\Local\Temp\9040.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\90AD.tmp"C:\Users\Admin\AppData\Local\Temp\90AD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\911B.tmp"C:\Users\Admin\AppData\Local\Temp\911B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\9198.tmp"C:\Users\Admin\AppData\Local\Temp\9198.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\9205.tmp"C:\Users\Admin\AppData\Local\Temp\9205.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\9282.tmp"C:\Users\Admin\AppData\Local\Temp\9282.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\930F.tmp"C:\Users\Admin\AppData\Local\Temp\930F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\93AB.tmp"C:\Users\Admin\AppData\Local\Temp\93AB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\9418.tmp"C:\Users\Admin\AppData\Local\Temp\9418.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\94A5.tmp"C:\Users\Admin\AppData\Local\Temp\94A5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\9512.tmp"C:\Users\Admin\AppData\Local\Temp\9512.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\959F.tmp"C:\Users\Admin\AppData\Local\Temp\959F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\960C.tmp"C:\Users\Admin\AppData\Local\Temp\960C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\9689.tmp"C:\Users\Admin\AppData\Local\Temp\9689.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\9706.tmp"C:\Users\Admin\AppData\Local\Temp\9706.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\9783.tmp"C:\Users\Admin\AppData\Local\Temp\9783.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\981F.tmp"C:\Users\Admin\AppData\Local\Temp\981F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\989C.tmp"C:\Users\Admin\AppData\Local\Temp\989C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\9939.tmp"C:\Users\Admin\AppData\Local\Temp\9939.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\99B6.tmp"C:\Users\Admin\AppData\Local\Temp\99B6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\9D21.tmp"C:\Users\Admin\AppData\Local\Temp\9D21.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\9E2A.tmp"C:\Users\Admin\AppData\Local\Temp\9E2A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\9F34.tmp"C:\Users\Admin\AppData\Local\Temp\9F34.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"65⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\A08C.tmp"C:\Users\Admin\AppData\Local\Temp\A08C.tmp"66⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\A0F9.tmp"C:\Users\Admin\AppData\Local\Temp\A0F9.tmp"67⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\A186.tmp"C:\Users\Admin\AppData\Local\Temp\A186.tmp"68⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\A203.tmp"C:\Users\Admin\AppData\Local\Temp\A203.tmp"69⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\A270.tmp"C:\Users\Admin\AppData\Local\Temp\A270.tmp"70⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\A2FD.tmp"C:\Users\Admin\AppData\Local\Temp\A2FD.tmp"71⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\A36A.tmp"C:\Users\Admin\AppData\Local\Temp\A36A.tmp"72⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"73⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\A464.tmp"C:\Users\Admin\AppData\Local\Temp\A464.tmp"74⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\A500.tmp"C:\Users\Admin\AppData\Local\Temp\A500.tmp"75⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"76⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\A629.tmp"C:\Users\Admin\AppData\Local\Temp\A629.tmp"77⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\A6B6.tmp"C:\Users\Admin\AppData\Local\Temp\A6B6.tmp"78⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\A742.tmp"C:\Users\Admin\AppData\Local\Temp\A742.tmp"79⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"80⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\A82D.tmp"C:\Users\Admin\AppData\Local\Temp\A82D.tmp"81⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"82⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\A936.tmp"C:\Users\Admin\AppData\Local\Temp\A936.tmp"83⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"84⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"85⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\AACD.tmp"C:\Users\Admin\AppData\Local\Temp\AACD.tmp"86⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\AB59.tmp"C:\Users\Admin\AppData\Local\Temp\AB59.tmp"87⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\ABC7.tmp"C:\Users\Admin\AppData\Local\Temp\ABC7.tmp"88⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\AC53.tmp"C:\Users\Admin\AppData\Local\Temp\AC53.tmp"89⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"91⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\AE38.tmp"C:\Users\Admin\AppData\Local\Temp\AE38.tmp"92⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\AED4.tmp"C:\Users\Admin\AppData\Local\Temp\AED4.tmp"93⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\AF51.tmp"C:\Users\Admin\AppData\Local\Temp\AF51.tmp"94⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"95⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\B04B.tmp"C:\Users\Admin\AppData\Local\Temp\B04B.tmp"96⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"97⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"98⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"99⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"100⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\B2CC.tmp"C:\Users\Admin\AppData\Local\Temp\B2CC.tmp"101⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\B349.tmp"C:\Users\Admin\AppData\Local\Temp\B349.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"103⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\B462.tmp"C:\Users\Admin\AppData\Local\Temp\B462.tmp"104⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"105⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\B55C.tmp"C:\Users\Admin\AppData\Local\Temp\B55C.tmp"106⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"107⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\B685.tmp"C:\Users\Admin\AppData\Local\Temp\B685.tmp"108⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\B702.tmp"C:\Users\Admin\AppData\Local\Temp\B702.tmp"109⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"110⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\B84A.tmp"C:\Users\Admin\AppData\Local\Temp\B84A.tmp"111⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\B8B7.tmp"C:\Users\Admin\AppData\Local\Temp\B8B7.tmp"112⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\B934.tmp"C:\Users\Admin\AppData\Local\Temp\B934.tmp"113⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"114⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"116⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\BB09.tmp"C:\Users\Admin\AppData\Local\Temp\BB09.tmp"117⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\BB86.tmp"C:\Users\Admin\AppData\Local\Temp\BB86.tmp"118⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\BC03.tmp"C:\Users\Admin\AppData\Local\Temp\BC03.tmp"119⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\BC70.tmp"C:\Users\Admin\AppData\Local\Temp\BC70.tmp"120⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\BCED.tmp"C:\Users\Admin\AppData\Local\Temp\BCED.tmp"121⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"122⤵PID:4320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-