Analysis
- max time kernel
131s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 20:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_3835e592cf99e71f1a76a3b5539ee3a7_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_3835e592cf99e71f1a76a3b5539ee3a7_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-19_3835e592cf99e71f1a76a3b5539ee3a7_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260819-y2ldmavycs
- SHA256 662da9a944ea3fabb444648c6e4b9f607c43081be08da7e52906b2df8dfe801a
- MD5 3835e592cf99e71f1a76a3b5539ee3a7
- SHA1 fbb4d91cef99f2716344f91797e5f5d812337f4f
- SHA512 69b5ea75cec31513a013e305431eb256b5040963993d397e5d18dad7fc839d8af0c8963ff82831b1371a4da82fd63f85699d304df22931e31aa1aba318d44c9e
- SSDEEP 12288:9U5rCOTei6jBbquBfm21kSeOq8FGmVqZoXWjdqpby1grA70G+o:9UQOJ6jBzf/qFmVqqGh4yATXo
- TLSH T1FBE402217685C432E9C612304FE2EBB2597EBD725B2164D73B80A72D6FB52E1A334347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4588 5C30.tmp 4272 5CFB.tmp 516 5D97.tmp 5988 5ED0.tmp 3800 5FF8.tmp 3296 60D3.tmp 4488 617F.tmp 1136 625A.tmp 5780 6306.tmp 2856 63D1.tmp 4640 649C.tmp 120 6567.tmp 3896 6613.tmp 5680 66CE.tmp 4676 678A.tmp 5944 6874.tmp 5396 6930.tmp 1120 6A0B.tmp 2340 6AC6.tmp 5768 6B82.tmp 692 6C3D.tmp 2664 6CE9.tmp 4192 6DC4.tmp 5868 6E60.tmp 3224 6F2B.tmp 5444 7015.tmp 5936 70F0.tmp 4860 71DB.tmp 744 72D5.tmp 4868 7371.tmp 5800 742C.tmp 4916 74F7.tmp 5604 7620.tmp 1088 76AD.tmp 3804 7749.tmp 4604 77E5.tmp 3856 7891.tmp 1736 790E.tmp 4428 79AB.tmp 4884 7A28.tmp 4904 7AB4.tmp 4880 7B70.tmp 3476 7BED.tmp 3464 7C89.tmp 6116 7D16.tmp 5332 7DC1.tmp 5884 7E4E.tmp 4324 7EDB.tmp 920 7F77.tmp 4288 8004.tmp 1500 8071.tmp 764 80EE.tmp 3248 815B.tmp 4804 81C9.tmp 5584 8265.tmp 3192 82D2.tmp 5880 835F.tmp 4172 83DC.tmp 3952 8459.tmp 4076 84D6.tmp 1908 8553.tmp 1760 85E0.tmp 4648 866C.tmp 4208 8718.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 440F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ED0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 188A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1605.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4449.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 990A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8004.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 328B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F83C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D836.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E16D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 278E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4552.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BED.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 4588 2916 2026-08-19_3835e592cf99e71f1a76a3b5539ee3a7_elex_mafia_stealc_tofsee.exe 89 PID 4588 wrote to memory of 4272 4588 5C30.tmp 90 PID 4272 wrote to memory of 516 4272 5CFB.tmp 91 PID 516 wrote to memory of 5988 516 5D97.tmp 92 PID 5988 wrote to memory of 3800 5988 5ED0.tmp 93 PID 3800 wrote to memory of 3296 3800 5FF8.tmp 94 PID 3296 wrote to memory of 4488 3296 60D3.tmp 95 PID 4488 wrote to memory of 1136 4488 617F.tmp 96 PID 1136 wrote to memory of 5780 1136 625A.tmp 97 PID 5780 wrote to memory of 2856 5780 6306.tmp 98 PID 2856 wrote to memory of 4640 2856 63D1.tmp 99 PID 4640 wrote to memory of 120 4640 649C.tmp 100 PID 120 wrote to memory of 3896 120 6567.tmp 101 PID 3896 wrote to memory of 5680 3896 6613.tmp 102 PID 5680 wrote to memory of 4676 5680 66CE.tmp 103 PID 4676 wrote to memory of 5944 4676 678A.tmp 104 PID 5944 wrote to memory of 5396 5944 6874.tmp 105 PID 5396 wrote to memory of 1120 5396 6930.tmp 106 PID 1120 wrote to memory of 2340 1120 6A0B.tmp 107 PID 2340 wrote to memory of 5768 2340 6AC6.tmp 108 PID 5768 wrote to memory of 692 5768 6B82.tmp 109 PID 692 wrote to memory of 2664 692 6C3D.tmp 110 PID 2664 wrote to memory of 4192 2664 6CE9.tmp 111 PID 4192 wrote to memory of 5868 4192 6DC4.tmp 112 PID 5868 wrote to memory of 3224 5868 6E60.tmp 113 PID 3224 wrote to memory of 5444 3224 6F2B.tmp 114 PID 5444 wrote to memory of 5936 5444 7015.tmp 115 PID 5936 wrote to memory of 4860 5936 70F0.tmp 116 PID 4860 wrote to memory of 744 4860 71DB.tmp 117 PID 744 wrote to memory of 4868 744 72D5.tmp 118 PID 4868 wrote to memory of 5800 4868 7371.tmp 119 PID 5800 wrote to memory of 4916 5800 742C.tmp 120 PID 4916 wrote to memory of 5604 4916 74F7.tmp 121 PID 5604 wrote to memory of 1088 5604 7620.tmp 122 PID 1088 wrote to memory of 3804 1088 76AD.tmp 123 PID 3804 wrote to memory of 4604 3804 7749.tmp 124 PID 4604 wrote to memory of 3856 4604 77E5.tmp 125 PID 3856 wrote to memory of 1736 3856 7891.tmp 126 PID 1736 wrote to memory of 4428 1736 790E.tmp 127 PID 4428 wrote to memory of 4884 4428 79AB.tmp 128 PID 4884 wrote to memory of 4904 4884 7A28.tmp 129 PID 4904 wrote to memory of 4880 4904 7AB4.tmp 130 PID 4880 wrote to memory of 3476 4880 7B70.tmp 131 PID 3476 wrote to memory of 3464 3476 7BED.tmp 132 PID 3464 wrote to memory of 6116 3464 7C89.tmp 133 PID 6116 wrote to memory of 5332 6116 7D16.tmp 134 PID 5332 wrote to memory of 5884 5332 7DC1.tmp 135 PID 5884 wrote to memory of 4324 5884 7E4E.tmp 136 PID 4324 wrote to memory of 920 4324 7EDB.tmp 137 PID 920 wrote to memory of 4288 920 7F77.tmp 138 PID 4288 wrote to memory of 1500 4288 8004.tmp 139 PID 1500 wrote to memory of 764 1500 8071.tmp 140 PID 764 wrote to memory of 3248 764 80EE.tmp 141 PID 3248 wrote to memory of 4804 3248 815B.tmp 142 PID 4804 wrote to memory of 5584 4804 81C9.tmp 143 PID 5584 wrote to memory of 3192 5584 8265.tmp 144 PID 3192 wrote to memory of 5880 3192 82D2.tmp 145 PID 5880 wrote to memory of 4172 5880 835F.tmp 146 PID 4172 wrote to memory of 3952 4172 83DC.tmp 147 PID 3952 wrote to memory of 4076 3952 8459.tmp 148 PID 4076 wrote to memory of 1908 4076 84D6.tmp 149 PID 1908 wrote to memory of 1760 1908 8553.tmp 150 PID 1760 wrote to memory of 4648 1760 85E0.tmp 151 PID 4648 wrote to memory of 4208 4648 866C.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_3835e592cf99e71f1a76a3b5539ee3a7_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_3835e592cf99e71f1a76a3b5539ee3a7_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\5C30.tmp"C:\Users\Admin\AppData\Local\Temp\5C30.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5CFB.tmp"C:\Users\Admin\AppData\Local\Temp\5CFB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\5D97.tmp"C:\Users\Admin\AppData\Local\Temp\5D97.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\5ED0.tmp"C:\Users\Admin\AppData\Local\Temp\5ED0.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\5FF8.tmp"C:\Users\Admin\AppData\Local\Temp\5FF8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\60D3.tmp"C:\Users\Admin\AppData\Local\Temp\60D3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\617F.tmp"C:\Users\Admin\AppData\Local\Temp\617F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\625A.tmp"C:\Users\Admin\AppData\Local\Temp\625A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\6306.tmp"C:\Users\Admin\AppData\Local\Temp\6306.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\63D1.tmp"C:\Users\Admin\AppData\Local\Temp\63D1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\649C.tmp"C:\Users\Admin\AppData\Local\Temp\649C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\678A.tmp"C:\Users\Admin\AppData\Local\Temp\678A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\6874.tmp"C:\Users\Admin\AppData\Local\Temp\6874.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\6930.tmp"C:\Users\Admin\AppData\Local\Temp\6930.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\6AC6.tmp"C:\Users\Admin\AppData\Local\Temp\6AC6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\6B82.tmp"C:\Users\Admin\AppData\Local\Temp\6B82.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\6E60.tmp"C:\Users\Admin\AppData\Local\Temp\6E60.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\7015.tmp"C:\Users\Admin\AppData\Local\Temp\7015.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\70F0.tmp"C:\Users\Admin\AppData\Local\Temp\70F0.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\71DB.tmp"C:\Users\Admin\AppData\Local\Temp\71DB.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\72D5.tmp"C:\Users\Admin\AppData\Local\Temp\72D5.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\7371.tmp"C:\Users\Admin\AppData\Local\Temp\7371.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\742C.tmp"C:\Users\Admin\AppData\Local\Temp\742C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\74F7.tmp"C:\Users\Admin\AppData\Local\Temp\74F7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\7620.tmp"C:\Users\Admin\AppData\Local\Temp\7620.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\76AD.tmp"C:\Users\Admin\AppData\Local\Temp\76AD.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\7749.tmp"C:\Users\Admin\AppData\Local\Temp\7749.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\77E5.tmp"C:\Users\Admin\AppData\Local\Temp\77E5.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\7891.tmp"C:\Users\Admin\AppData\Local\Temp\7891.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\790E.tmp"C:\Users\Admin\AppData\Local\Temp\790E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\79AB.tmp"C:\Users\Admin\AppData\Local\Temp\79AB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\7A28.tmp"C:\Users\Admin\AppData\Local\Temp\7A28.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\7B70.tmp"C:\Users\Admin\AppData\Local\Temp\7B70.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\7BED.tmp"C:\Users\Admin\AppData\Local\Temp\7BED.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\7C89.tmp"C:\Users\Admin\AppData\Local\Temp\7C89.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\7D16.tmp"C:\Users\Admin\AppData\Local\Temp\7D16.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\7DC1.tmp"C:\Users\Admin\AppData\Local\Temp\7DC1.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\7E4E.tmp"C:\Users\Admin\AppData\Local\Temp\7E4E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\7F77.tmp"C:\Users\Admin\AppData\Local\Temp\7F77.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\8004.tmp"C:\Users\Admin\AppData\Local\Temp\8004.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\8071.tmp"C:\Users\Admin\AppData\Local\Temp\8071.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\80EE.tmp"C:\Users\Admin\AppData\Local\Temp\80EE.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\815B.tmp"C:\Users\Admin\AppData\Local\Temp\815B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\81C9.tmp"C:\Users\Admin\AppData\Local\Temp\81C9.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\82D2.tmp"C:\Users\Admin\AppData\Local\Temp\82D2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\835F.tmp"C:\Users\Admin\AppData\Local\Temp\835F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\83DC.tmp"C:\Users\Admin\AppData\Local\Temp\83DC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\8459.tmp"C:\Users\Admin\AppData\Local\Temp\8459.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\84D6.tmp"C:\Users\Admin\AppData\Local\Temp\84D6.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\8553.tmp"C:\Users\Admin\AppData\Local\Temp\8553.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\85E0.tmp"C:\Users\Admin\AppData\Local\Temp\85E0.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\866C.tmp"C:\Users\Admin\AppData\Local\Temp\866C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\8718.tmp"C:\Users\Admin\AppData\Local\Temp\8718.tmp"65⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8785.tmp"C:\Users\Admin\AppData\Local\Temp\8785.tmp"66⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\8831.tmp"C:\Users\Admin\AppData\Local\Temp\8831.tmp"67⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\889F.tmp"C:\Users\Admin\AppData\Local\Temp\889F.tmp"68⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\892B.tmp"C:\Users\Admin\AppData\Local\Temp\892B.tmp"69⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"70⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\8A83.tmp"C:\Users\Admin\AppData\Local\Temp\8A83.tmp"71⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\8B1F.tmp"C:\Users\Admin\AppData\Local\Temp\8B1F.tmp"72⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"73⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\8C67.tmp"C:\Users\Admin\AppData\Local\Temp\8C67.tmp"74⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"75⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"76⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"77⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"78⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"79⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\8FE2.tmp"C:\Users\Admin\AppData\Local\Temp\8FE2.tmp"80⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\908E.tmp"C:\Users\Admin\AppData\Local\Temp\908E.tmp"81⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\911B.tmp"C:\Users\Admin\AppData\Local\Temp\911B.tmp"82⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\9198.tmp"C:\Users\Admin\AppData\Local\Temp\9198.tmp"83⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\9224.tmp"C:\Users\Admin\AppData\Local\Temp\9224.tmp"84⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"85⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\933D.tmp"C:\Users\Admin\AppData\Local\Temp\933D.tmp"86⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\93DA.tmp"C:\Users\Admin\AppData\Local\Temp\93DA.tmp"87⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\9457.tmp"C:\Users\Admin\AppData\Local\Temp\9457.tmp"88⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\94E3.tmp"C:\Users\Admin\AppData\Local\Temp\94E3.tmp"89⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\9570.tmp"C:\Users\Admin\AppData\Local\Temp\9570.tmp"90⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\95FD.tmp"C:\Users\Admin\AppData\Local\Temp\95FD.tmp"91⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\967A.tmp"C:\Users\Admin\AppData\Local\Temp\967A.tmp"92⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\9706.tmp"C:\Users\Admin\AppData\Local\Temp\9706.tmp"93⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\9783.tmp"C:\Users\Admin\AppData\Local\Temp\9783.tmp"94⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\9800.tmp"C:\Users\Admin\AppData\Local\Temp\9800.tmp"95⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\988D.tmp"C:\Users\Admin\AppData\Local\Temp\988D.tmp"96⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\990A.tmp"C:\Users\Admin\AppData\Local\Temp\990A.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\9987.tmp"C:\Users\Admin\AppData\Local\Temp\9987.tmp"98⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\9A04.tmp"C:\Users\Admin\AppData\Local\Temp\9A04.tmp"99⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\9A90.tmp"C:\Users\Admin\AppData\Local\Temp\9A90.tmp"100⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\9AFE.tmp"C:\Users\Admin\AppData\Local\Temp\9AFE.tmp"101⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\9B8A.tmp"C:\Users\Admin\AppData\Local\Temp\9B8A.tmp"102⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\9C07.tmp"C:\Users\Admin\AppData\Local\Temp\9C07.tmp"103⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"104⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\9D21.tmp"C:\Users\Admin\AppData\Local\Temp\9D21.tmp"105⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"106⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\9E78.tmp"C:\Users\Admin\AppData\Local\Temp\9E78.tmp"107⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\9F15.tmp"C:\Users\Admin\AppData\Local\Temp\9F15.tmp"108⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\9FB1.tmp"C:\Users\Admin\AppData\Local\Temp\9FB1.tmp"109⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\A02E.tmp"C:\Users\Admin\AppData\Local\Temp\A02E.tmp"110⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\A147.tmp"C:\Users\Admin\AppData\Local\Temp\A147.tmp"112⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"113⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\A280.tmp"C:\Users\Admin\AppData\Local\Temp\A280.tmp"114⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\A31C.tmp"C:\Users\Admin\AppData\Local\Temp\A31C.tmp"115⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"116⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\A445.tmp"C:\Users\Admin\AppData\Local\Temp\A445.tmp"117⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"118⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\A53F.tmp"C:\Users\Admin\AppData\Local\Temp\A53F.tmp"119⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\A5DB.tmp"C:\Users\Admin\AppData\Local\Temp\A5DB.tmp"120⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\A658.tmp"C:\Users\Admin\AppData\Local\Temp\A658.tmp"121⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"122⤵PID:4244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-