Analysis
- max time kernel
70s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 12:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_0f8340af5c7d573e428234f242dffcb6_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_0f8340af5c7d573e428234f242dffcb6_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-22_0f8340af5c7d573e428234f242dffcb6_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260823-ptwpysgn4t
- SHA256 959c613c559023081c8358fe42790152fb053686adfeca6b4b5d9aaf267ed231
- MD5 0f8340af5c7d573e428234f242dffcb6
- SHA1 98f37717b2eb8b20258338c94dc402cec8eb68a9
- SHA512 39e5fcec746a98ef666261b55ae5e9470af2c9fae4efc2fa8d450b38664ebba542440aae3f84ca9b41499f25e2658c6aeef3c9c5c5cadbb8ea90edf3d16957c6
- SSDEEP 12288:wU5rCOTeiDxt9ONPwX/shViM7lI1+P3NZ+3/v+I9hUG2VA:wUQOJDtYPwvsviEHP3NGEA
- TLSH T134E4D12173D88632E5FB037859B5E6614D7EBD229722D6CF2F8012AE0D71BC08A71763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1184 DAD6.tmp 2308 DC4D.tmp 1096 DE60.tmp 4120 DF89.tmp 4912 E044.tmp 4140 E13E.tmp 2548 E248.tmp 3256 E323.tmp 4448 E41D.tmp 4196 E574.tmp 5736 E65F.tmp 2056 E759.tmp 5688 E891.tmp 4384 E9AA.tmp 1456 EA95.tmp 3016 EB8F.tmp 5232 ECC7.tmp 992 EDE1.tmp 5008 EEFA.tmp 3496 F052.tmp 6104 F16B.tmp 4832 F294.tmp 2540 F3AD.tmp 3200 F497.tmp 1612 F572.tmp 1780 F65C.tmp 5756 F776.tmp 5716 F88F.tmp 3036 F979.tmp 5408 FA54.tmp 3408 FB3E.tmp 1112 FC38.tmp 4812 FD13.tmp 2356 FD90.tmp 4340 FE1D.tmp 448 FEB9.tmp 1532 FF94.tmp 1820 4F.tmp 2536 149.tmp 1204 1D6.tmp 3388 291.tmp 5912 34D.tmp 1084 3CA.tmp 3448 466.tmp 6016 4F3.tmp 4984 58F.tmp 4500 679.tmp 4492 754.tmp 4548 7E1.tmp 3260 87D.tmp 5780 8FA.tmp 5208 967.tmp 1856 9E4.tmp 1940 A61.tmp 240 AEE.tmp 4124 B6B.tmp 5932 C17.tmp 4320 C94.tmp 4588 D11.tmp 4904 D9E.tmp 4508 E2A.tmp 4004 EB7.tmp 1968 F34.tmp 3012 FB1.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A48E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E759.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 252D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8251.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 185C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 614B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 203B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B622.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B75B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 737C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8713.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4716 wrote to memory of 1184 4716 2026-08-22_0f8340af5c7d573e428234f242dffcb6_elex_mafia_stealc_tofsee.exe 88 PID 1184 wrote to memory of 2308 1184 DAD6.tmp 89 PID 2308 wrote to memory of 1096 2308 DC4D.tmp 90 PID 1096 wrote to memory of 4120 1096 DE60.tmp 91 PID 4120 wrote to memory of 4912 4120 DF89.tmp 92 PID 4912 wrote to memory of 4140 4912 E044.tmp 93 PID 4140 wrote to memory of 2548 4140 E13E.tmp 94 PID 2548 wrote to memory of 3256 2548 E248.tmp 95 PID 3256 wrote to memory of 4448 3256 E323.tmp 96 PID 4448 wrote to memory of 4196 4448 E41D.tmp 97 PID 4196 wrote to memory of 5736 4196 E574.tmp 98 PID 5736 wrote to memory of 2056 5736 E65F.tmp 99 PID 2056 wrote to memory of 5688 2056 E759.tmp 100 PID 5688 wrote to memory of 4384 5688 E891.tmp 101 PID 4384 wrote to memory of 1456 4384 E9AA.tmp 102 PID 1456 wrote to memory of 3016 1456 EA95.tmp 103 PID 3016 wrote to memory of 5232 3016 EB8F.tmp 104 PID 5232 wrote to memory of 992 5232 ECC7.tmp 105 PID 992 wrote to memory of 5008 992 EDE1.tmp 106 PID 5008 wrote to memory of 3496 5008 EEFA.tmp 107 PID 3496 wrote to memory of 6104 3496 F052.tmp 108 PID 6104 wrote to memory of 4832 6104 F16B.tmp 109 PID 4832 wrote to memory of 2540 4832 F294.tmp 110 PID 2540 wrote to memory of 3200 2540 F3AD.tmp 111 PID 3200 wrote to memory of 1612 3200 F497.tmp 112 PID 1612 wrote to memory of 1780 1612 F572.tmp 113 PID 1780 wrote to memory of 5756 1780 F65C.tmp 114 PID 5756 wrote to memory of 5716 5756 F776.tmp 115 PID 5716 wrote to memory of 3036 5716 F88F.tmp 116 PID 3036 wrote to memory of 5408 3036 F979.tmp 117 PID 5408 wrote to memory of 3408 5408 FA54.tmp 118 PID 3408 wrote to memory of 1112 3408 FB3E.tmp 119 PID 1112 wrote to memory of 4812 1112 FC38.tmp 120 PID 4812 wrote to memory of 2356 4812 FD13.tmp 121 PID 2356 wrote to memory of 4340 2356 FD90.tmp 122 PID 4340 wrote to memory of 448 4340 FE1D.tmp 123 PID 448 wrote to memory of 1532 448 FEB9.tmp 124 PID 1532 wrote to memory of 1820 1532 FF94.tmp 125 PID 1820 wrote to memory of 2536 1820 4F.tmp 126 PID 2536 wrote to memory of 1204 2536 149.tmp 127 PID 1204 wrote to memory of 3388 1204 1D6.tmp 128 PID 3388 wrote to memory of 5912 3388 291.tmp 129 PID 5912 wrote to memory of 1084 5912 34D.tmp 130 PID 1084 wrote to memory of 3448 1084 3CA.tmp 131 PID 3448 wrote to memory of 6016 3448 466.tmp 132 PID 6016 wrote to memory of 4984 6016 4F3.tmp 133 PID 4984 wrote to memory of 4500 4984 58F.tmp 134 PID 4500 wrote to memory of 4492 4500 679.tmp 135 PID 4492 wrote to memory of 4548 4492 754.tmp 136 PID 4548 wrote to memory of 3260 4548 7E1.tmp 137 PID 3260 wrote to memory of 5780 3260 87D.tmp 138 PID 5780 wrote to memory of 5208 5780 8FA.tmp 139 PID 5208 wrote to memory of 1856 5208 967.tmp 140 PID 1856 wrote to memory of 1940 1856 9E4.tmp 141 PID 1940 wrote to memory of 240 1940 A61.tmp 142 PID 240 wrote to memory of 4124 240 AEE.tmp 143 PID 4124 wrote to memory of 5932 4124 B6B.tmp 144 PID 5932 wrote to memory of 4320 5932 C17.tmp 145 PID 4320 wrote to memory of 4588 4320 C94.tmp 146 PID 4588 wrote to memory of 4904 4588 D11.tmp 147 PID 4904 wrote to memory of 4508 4904 D9E.tmp 148 PID 4508 wrote to memory of 4004 4508 E2A.tmp 149 PID 4004 wrote to memory of 1968 4004 EB7.tmp 150 PID 1968 wrote to memory of 3012 1968 F34.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_0f8340af5c7d573e428234f242dffcb6_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_0f8340af5c7d573e428234f242dffcb6_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\DE60.tmp"C:\Users\Admin\AppData\Local\Temp\DE60.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\DF89.tmp"C:\Users\Admin\AppData\Local\Temp\DF89.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\E044.tmp"C:\Users\Admin\AppData\Local\Temp\E044.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\E13E.tmp"C:\Users\Admin\AppData\Local\Temp\E13E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\E248.tmp"C:\Users\Admin\AppData\Local\Temp\E248.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\E323.tmp"C:\Users\Admin\AppData\Local\Temp\E323.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\E41D.tmp"C:\Users\Admin\AppData\Local\Temp\E41D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\E574.tmp"C:\Users\Admin\AppData\Local\Temp\E574.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\E759.tmp"C:\Users\Admin\AppData\Local\Temp\E759.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\E891.tmp"C:\Users\Admin\AppData\Local\Temp\E891.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\EB8F.tmp"C:\Users\Admin\AppData\Local\Temp\EB8F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\F052.tmp"C:\Users\Admin\AppData\Local\Temp\F052.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\F16B.tmp"C:\Users\Admin\AppData\Local\Temp\F16B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\F294.tmp"C:\Users\Admin\AppData\Local\Temp\F294.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\F3AD.tmp"C:\Users\Admin\AppData\Local\Temp\F3AD.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\F65C.tmp"C:\Users\Admin\AppData\Local\Temp\F65C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\F776.tmp"C:\Users\Admin\AppData\Local\Temp\F776.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\F88F.tmp"C:\Users\Admin\AppData\Local\Temp\F88F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\F979.tmp"C:\Users\Admin\AppData\Local\Temp\F979.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\FA54.tmp"C:\Users\Admin\AppData\Local\Temp\FA54.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\FC38.tmp"C:\Users\Admin\AppData\Local\Temp\FC38.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\FD13.tmp"C:\Users\Admin\AppData\Local\Temp\FD13.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\FD90.tmp"C:\Users\Admin\AppData\Local\Temp\FD90.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\149.tmp"C:\Users\Admin\AppData\Local\Temp\149.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\1D6.tmp"C:\Users\Admin\AppData\Local\Temp\1D6.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\291.tmp"C:\Users\Admin\AppData\Local\Temp\291.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\34D.tmp"C:\Users\Admin\AppData\Local\Temp\34D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\3CA.tmp"C:\Users\Admin\AppData\Local\Temp\3CA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\466.tmp"C:\Users\Admin\AppData\Local\Temp\466.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\4F3.tmp"C:\Users\Admin\AppData\Local\Temp\4F3.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\58F.tmp"C:\Users\Admin\AppData\Local\Temp\58F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\679.tmp"C:\Users\Admin\AppData\Local\Temp\679.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\754.tmp"C:\Users\Admin\AppData\Local\Temp\754.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\7E1.tmp"C:\Users\Admin\AppData\Local\Temp\7E1.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\87D.tmp"C:\Users\Admin\AppData\Local\Temp\87D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\8FA.tmp"C:\Users\Admin\AppData\Local\Temp\8FA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\967.tmp"C:\Users\Admin\AppData\Local\Temp\967.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\9E4.tmp"C:\Users\Admin\AppData\Local\Temp\9E4.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\A61.tmp"C:\Users\Admin\AppData\Local\Temp\A61.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\AEE.tmp"C:\Users\Admin\AppData\Local\Temp\AEE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\B6B.tmp"C:\Users\Admin\AppData\Local\Temp\B6B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\C17.tmp"C:\Users\Admin\AppData\Local\Temp\C17.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\C94.tmp"C:\Users\Admin\AppData\Local\Temp\C94.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\D11.tmp"C:\Users\Admin\AppData\Local\Temp\D11.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\D9E.tmp"C:\Users\Admin\AppData\Local\Temp\D9E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\E2A.tmp"C:\Users\Admin\AppData\Local\Temp\E2A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\EB7.tmp"C:\Users\Admin\AppData\Local\Temp\EB7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\F34.tmp"C:\Users\Admin\AppData\Local\Temp\F34.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\FB1.tmp"C:\Users\Admin\AppData\Local\Temp\FB1.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\102E.tmp"C:\Users\Admin\AppData\Local\Temp\102E.tmp"66⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\10AB.tmp"C:\Users\Admin\AppData\Local\Temp\10AB.tmp"67⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\1128.tmp"C:\Users\Admin\AppData\Local\Temp\1128.tmp"68⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\1195.tmp"C:\Users\Admin\AppData\Local\Temp\1195.tmp"69⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\1212.tmp"C:\Users\Admin\AppData\Local\Temp\1212.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\128F.tmp"C:\Users\Admin\AppData\Local\Temp\128F.tmp"71⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"72⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\1399.tmp"C:\Users\Admin\AppData\Local\Temp\1399.tmp"73⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\1435.tmp"C:\Users\Admin\AppData\Local\Temp\1435.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\14D1.tmp"C:\Users\Admin\AppData\Local\Temp\14D1.tmp"75⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\153F.tmp"C:\Users\Admin\AppData\Local\Temp\153F.tmp"76⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\15BC.tmp"C:\Users\Admin\AppData\Local\Temp\15BC.tmp"77⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\1629.tmp"C:\Users\Admin\AppData\Local\Temp\1629.tmp"78⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\16B6.tmp"C:\Users\Admin\AppData\Local\Temp\16B6.tmp"79⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\1752.tmp"C:\Users\Admin\AppData\Local\Temp\1752.tmp"80⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\17DF.tmp"C:\Users\Admin\AppData\Local\Temp\17DF.tmp"81⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\185C.tmp"C:\Users\Admin\AppData\Local\Temp\185C.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\18D9.tmp"C:\Users\Admin\AppData\Local\Temp\18D9.tmp"83⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\1965.tmp"C:\Users\Admin\AppData\Local\Temp\1965.tmp"84⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\19E2.tmp"C:\Users\Admin\AppData\Local\Temp\19E2.tmp"85⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\1A50.tmp"C:\Users\Admin\AppData\Local\Temp\1A50.tmp"86⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"87⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\1B69.tmp"C:\Users\Admin\AppData\Local\Temp\1B69.tmp"88⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"89⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\1C53.tmp"C:\Users\Admin\AppData\Local\Temp\1C53.tmp"90⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"91⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"92⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\1E28.tmp"C:\Users\Admin\AppData\Local\Temp\1E28.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\1EB5.tmp"C:\Users\Admin\AppData\Local\Temp\1EB5.tmp"94⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\1F32.tmp"C:\Users\Admin\AppData\Local\Temp\1F32.tmp"95⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"96⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\203B.tmp"C:\Users\Admin\AppData\Local\Temp\203B.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\20B8.tmp"C:\Users\Admin\AppData\Local\Temp\20B8.tmp"98⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\2135.tmp"C:\Users\Admin\AppData\Local\Temp\2135.tmp"99⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"100⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\222F.tmp"C:\Users\Admin\AppData\Local\Temp\222F.tmp"101⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\22BC.tmp"C:\Users\Admin\AppData\Local\Temp\22BC.tmp"102⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\2329.tmp"C:\Users\Admin\AppData\Local\Temp\2329.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"104⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\2423.tmp"C:\Users\Admin\AppData\Local\Temp\2423.tmp"105⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:256 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"108⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"109⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"110⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\277F.tmp"C:\Users\Admin\AppData\Local\Temp\277F.tmp"111⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\281B.tmp"C:\Users\Admin\AppData\Local\Temp\281B.tmp"112⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\2898.tmp"C:\Users\Admin\AppData\Local\Temp\2898.tmp"113⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\2915.tmp"C:\Users\Admin\AppData\Local\Temp\2915.tmp"114⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\2992.tmp"C:\Users\Admin\AppData\Local\Temp\2992.tmp"115⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\2A2E.tmp"C:\Users\Admin\AppData\Local\Temp\2A2E.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\2ABB.tmp"C:\Users\Admin\AppData\Local\Temp\2ABB.tmp"117⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\2B38.tmp"C:\Users\Admin\AppData\Local\Temp\2B38.tmp"118⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"119⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\2C22.tmp"C:\Users\Admin\AppData\Local\Temp\2C22.tmp"120⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"122⤵PID:724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-