Analysis
- max time kernel
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 05:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_a376b7a2c67a8dc819d899917833701e_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_a376b7a2c67a8dc819d899917833701e_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-24_a376b7a2c67a8dc819d899917833701e_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260825-f8allaxbme
- SHA256 57a6b5b3dd0482abe8c3446ff89df9c46d63e98ec289d25bb45b057785d619ab
- MD5 a376b7a2c67a8dc819d899917833701e
- SHA1 d7de9a3051aa8994d7d72b9009af3da711dafb0b
- SHA512 c05b1f3883ffc91987709dab3851c18b11e9206940c730b837c21debd7c13d76f131a09b321689dd1770eb2f052b8055f551c1351d92794df87aaf1626392671
- SSDEEP 12288:NU5rCOTeijC2QFaFzU2R/knM/umYZyzwtXTZwlH4Hp:NUQOJjHlYSsM/umYZPNTSlH4Hp
- TLSH T14CB4F126B245C133E28202701EE6DBE26A3BBD355726A4C33B84636D2FB16D1D779307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4684 F497.tmp 2164 F543.tmp 1268 F60E.tmp 4584 F718.tmp 4672 F7A5.tmp 4660 F831.tmp 2984 F89F.tmp 5316 F93B.tmp 5000 F9D7.tmp 2676 FA73.tmp 4520 FB1F.tmp 5736 FBAC.tmp 3708 FC77.tmp 2072 FD13.tmp 2936 FDBF.tmp 5704 FE5B.tmp 3476 FF07.tmp 4912 FFB3.tmp 4948 30.tmp 5392 CC.tmp 1408 159.tmp 3260 234.tmp 2016 2C0.tmp 2448 38B.tmp 2768 428.tmp 3008 4C4.tmp 3404 58F.tmp 5788 60C.tmp 2360 689.tmp 4664 716.tmp 5460 7C2.tmp 3944 84E.tmp 4348 8FA.tmp 2732 977.tmp 5412 9F4.tmp 5992 A81.tmp 960 ADE.tmp 2624 B5B.tmp 5140 BD8.tmp 3336 C55.tmp 1704 CD2.tmp 5916 D4F.tmp 3956 DBD.tmp 3948 E3A.tmp 2452 EB7.tmp 4824 F43.tmp 3064 FD0.tmp 8 105D.tmp 4208 1109.tmp 2824 11B4.tmp 808 1222.tmp 4376 12AE.tmp 5824 133B.tmp 4380 13B8.tmp 4216 1435.tmp 2288 14C2.tmp 1940 151F.tmp 3616 15BC.tmp 5308 1658.tmp 616 16F4.tmp 480 1771.tmp 1512 17FE.tmp 1816 186B.tmp 4560 18E8.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1430.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 585D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9324.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A605.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 736C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B35E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 633B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8113.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6231.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ACC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C65A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6686.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F497.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 341C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E37C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E011.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A49E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 122D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2680 wrote to memory of 4684 2680 2026-08-24_a376b7a2c67a8dc819d899917833701e_elex_mafia_stealc_tofsee.exe 88 PID 4684 wrote to memory of 2164 4684 F497.tmp 89 PID 2164 wrote to memory of 1268 2164 F543.tmp 90 PID 1268 wrote to memory of 4584 1268 F60E.tmp 91 PID 4584 wrote to memory of 4672 4584 F718.tmp 92 PID 4672 wrote to memory of 4660 4672 F7A5.tmp 93 PID 4660 wrote to memory of 2984 4660 F831.tmp 94 PID 2984 wrote to memory of 5316 2984 F89F.tmp 95 PID 5316 wrote to memory of 5000 5316 F93B.tmp 96 PID 5000 wrote to memory of 2676 5000 F9D7.tmp 97 PID 2676 wrote to memory of 4520 2676 FA73.tmp 98 PID 4520 wrote to memory of 5736 4520 FB1F.tmp 99 PID 5736 wrote to memory of 3708 5736 FBAC.tmp 100 PID 3708 wrote to memory of 2072 3708 FC77.tmp 101 PID 2072 wrote to memory of 2936 2072 FD13.tmp 102 PID 2936 wrote to memory of 5704 2936 FDBF.tmp 103 PID 5704 wrote to memory of 3476 5704 FE5B.tmp 104 PID 3476 wrote to memory of 4912 3476 FF07.tmp 105 PID 4912 wrote to memory of 4948 4912 FFB3.tmp 106 PID 4948 wrote to memory of 5392 4948 30.tmp 107 PID 5392 wrote to memory of 1408 5392 CC.tmp 108 PID 1408 wrote to memory of 3260 1408 159.tmp 109 PID 3260 wrote to memory of 2016 3260 234.tmp 110 PID 2016 wrote to memory of 2448 2016 2C0.tmp 111 PID 2448 wrote to memory of 2768 2448 38B.tmp 112 PID 2768 wrote to memory of 3008 2768 428.tmp 113 PID 3008 wrote to memory of 3404 3008 4C4.tmp 114 PID 3404 wrote to memory of 5788 3404 58F.tmp 115 PID 5788 wrote to memory of 2360 5788 60C.tmp 116 PID 2360 wrote to memory of 4664 2360 689.tmp 117 PID 4664 wrote to memory of 5460 4664 716.tmp 118 PID 5460 wrote to memory of 3944 5460 7C2.tmp 119 PID 3944 wrote to memory of 4348 3944 84E.tmp 120 PID 4348 wrote to memory of 2732 4348 8FA.tmp 121 PID 2732 wrote to memory of 5412 2732 977.tmp 122 PID 5412 wrote to memory of 5992 5412 9F4.tmp 123 PID 5992 wrote to memory of 960 5992 A81.tmp 124 PID 960 wrote to memory of 2624 960 ADE.tmp 125 PID 2624 wrote to memory of 5140 2624 B5B.tmp 126 PID 5140 wrote to memory of 3336 5140 BD8.tmp 127 PID 3336 wrote to memory of 1704 3336 C55.tmp 128 PID 1704 wrote to memory of 5916 1704 CD2.tmp 129 PID 5916 wrote to memory of 3956 5916 D4F.tmp 130 PID 3956 wrote to memory of 3948 3956 DBD.tmp 131 PID 3948 wrote to memory of 2452 3948 E3A.tmp 132 PID 2452 wrote to memory of 4824 2452 EB7.tmp 133 PID 4824 wrote to memory of 3064 4824 F43.tmp 134 PID 3064 wrote to memory of 8 3064 FD0.tmp 135 PID 8 wrote to memory of 4208 8 105D.tmp 136 PID 4208 wrote to memory of 2824 4208 1109.tmp 137 PID 2824 wrote to memory of 808 2824 11B4.tmp 138 PID 808 wrote to memory of 4376 808 1222.tmp 139 PID 4376 wrote to memory of 5824 4376 12AE.tmp 140 PID 5824 wrote to memory of 4380 5824 133B.tmp 141 PID 4380 wrote to memory of 4216 4380 13B8.tmp 142 PID 4216 wrote to memory of 2288 4216 1435.tmp 143 PID 2288 wrote to memory of 1940 2288 14C2.tmp 144 PID 1940 wrote to memory of 3616 1940 151F.tmp 145 PID 3616 wrote to memory of 5308 3616 15BC.tmp 146 PID 5308 wrote to memory of 616 5308 1658.tmp 147 PID 616 wrote to memory of 480 616 16F4.tmp 148 PID 480 wrote to memory of 1512 480 1771.tmp 149 PID 1512 wrote to memory of 1816 1512 17FE.tmp 150 PID 1816 wrote to memory of 4560 1816 186B.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_a376b7a2c67a8dc819d899917833701e_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_a376b7a2c67a8dc819d899917833701e_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\F543.tmp"C:\Users\Admin\AppData\Local\Temp\F543.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\F60E.tmp"C:\Users\Admin\AppData\Local\Temp\F60E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\F718.tmp"C:\Users\Admin\AppData\Local\Temp\F718.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\F7A5.tmp"C:\Users\Admin\AppData\Local\Temp\F7A5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\F831.tmp"C:\Users\Admin\AppData\Local\Temp\F831.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\F89F.tmp"C:\Users\Admin\AppData\Local\Temp\F89F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\F93B.tmp"C:\Users\Admin\AppData\Local\Temp\F93B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\FA73.tmp"C:\Users\Admin\AppData\Local\Temp\FA73.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\FBAC.tmp"C:\Users\Admin\AppData\Local\Temp\FBAC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\FC77.tmp"C:\Users\Admin\AppData\Local\Temp\FC77.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\FD13.tmp"C:\Users\Admin\AppData\Local\Temp\FD13.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\159.tmp"C:\Users\Admin\AppData\Local\Temp\159.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\234.tmp"C:\Users\Admin\AppData\Local\Temp\234.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\2C0.tmp"C:\Users\Admin\AppData\Local\Temp\2C0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\38B.tmp"C:\Users\Admin\AppData\Local\Temp\38B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\428.tmp"C:\Users\Admin\AppData\Local\Temp\428.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4C4.tmp"C:\Users\Admin\AppData\Local\Temp\4C4.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\58F.tmp"C:\Users\Admin\AppData\Local\Temp\58F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\60C.tmp"C:\Users\Admin\AppData\Local\Temp\60C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\689.tmp"C:\Users\Admin\AppData\Local\Temp\689.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\716.tmp"C:\Users\Admin\AppData\Local\Temp\716.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\7C2.tmp"C:\Users\Admin\AppData\Local\Temp\7C2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\84E.tmp"C:\Users\Admin\AppData\Local\Temp\84E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\8FA.tmp"C:\Users\Admin\AppData\Local\Temp\8FA.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\977.tmp"C:\Users\Admin\AppData\Local\Temp\977.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\9F4.tmp"C:\Users\Admin\AppData\Local\Temp\9F4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\A81.tmp"C:\Users\Admin\AppData\Local\Temp\A81.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\ADE.tmp"C:\Users\Admin\AppData\Local\Temp\ADE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\B5B.tmp"C:\Users\Admin\AppData\Local\Temp\B5B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\BD8.tmp"C:\Users\Admin\AppData\Local\Temp\BD8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\C55.tmp"C:\Users\Admin\AppData\Local\Temp\C55.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\CD2.tmp"C:\Users\Admin\AppData\Local\Temp\CD2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\D4F.tmp"C:\Users\Admin\AppData\Local\Temp\D4F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\DBD.tmp"C:\Users\Admin\AppData\Local\Temp\DBD.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\E3A.tmp"C:\Users\Admin\AppData\Local\Temp\E3A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\EB7.tmp"C:\Users\Admin\AppData\Local\Temp\EB7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\F43.tmp"C:\Users\Admin\AppData\Local\Temp\F43.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\FD0.tmp"C:\Users\Admin\AppData\Local\Temp\FD0.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\105D.tmp"C:\Users\Admin\AppData\Local\Temp\105D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\1109.tmp"C:\Users\Admin\AppData\Local\Temp\1109.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\11B4.tmp"C:\Users\Admin\AppData\Local\Temp\11B4.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1222.tmp"C:\Users\Admin\AppData\Local\Temp\1222.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\12AE.tmp"C:\Users\Admin\AppData\Local\Temp\12AE.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\133B.tmp"C:\Users\Admin\AppData\Local\Temp\133B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\13B8.tmp"C:\Users\Admin\AppData\Local\Temp\13B8.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\1435.tmp"C:\Users\Admin\AppData\Local\Temp\1435.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\14C2.tmp"C:\Users\Admin\AppData\Local\Temp\14C2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\151F.tmp"C:\Users\Admin\AppData\Local\Temp\151F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\15BC.tmp"C:\Users\Admin\AppData\Local\Temp\15BC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\16F4.tmp"C:\Users\Admin\AppData\Local\Temp\16F4.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\1771.tmp"C:\Users\Admin\AppData\Local\Temp\1771.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\17FE.tmp"C:\Users\Admin\AppData\Local\Temp\17FE.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\186B.tmp"C:\Users\Admin\AppData\Local\Temp\186B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\18E8.tmp"C:\Users\Admin\AppData\Local\Temp\18E8.tmp"65⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\19C3.tmp"C:\Users\Admin\AppData\Local\Temp\19C3.tmp"66⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\1A50.tmp"C:\Users\Admin\AppData\Local\Temp\1A50.tmp"67⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"68⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\1B59.tmp"C:\Users\Admin\AppData\Local\Temp\1B59.tmp"69⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"70⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\1C72.tmp"C:\Users\Admin\AppData\Local\Temp\1C72.tmp"71⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"72⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\1D7C.tmp"C:\Users\Admin\AppData\Local\Temp\1D7C.tmp"73⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\1E09.tmp"C:\Users\Admin\AppData\Local\Temp\1E09.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\1E95.tmp"C:\Users\Admin\AppData\Local\Temp\1E95.tmp"75⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\1F12.tmp"C:\Users\Admin\AppData\Local\Temp\1F12.tmp"76⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\1F80.tmp"C:\Users\Admin\AppData\Local\Temp\1F80.tmp"77⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"78⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\2089.tmp"C:\Users\Admin\AppData\Local\Temp\2089.tmp"79⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\2106.tmp"C:\Users\Admin\AppData\Local\Temp\2106.tmp"80⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\2164.tmp"C:\Users\Admin\AppData\Local\Temp\2164.tmp"81⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\21D1.tmp"C:\Users\Admin\AppData\Local\Temp\21D1.tmp"82⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\224E.tmp"C:\Users\Admin\AppData\Local\Temp\224E.tmp"83⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\22DB.tmp"C:\Users\Admin\AppData\Local\Temp\22DB.tmp"84⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\23F4.tmp"C:\Users\Admin\AppData\Local\Temp\23F4.tmp"86⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"87⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"88⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"89⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"90⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\2685.tmp"C:\Users\Admin\AppData\Local\Temp\2685.tmp"91⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\2702.tmp"C:\Users\Admin\AppData\Local\Temp\2702.tmp"92⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\278E.tmp"C:\Users\Admin\AppData\Local\Temp\278E.tmp"93⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\27FC.tmp"C:\Users\Admin\AppData\Local\Temp\27FC.tmp"94⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\2879.tmp"C:\Users\Admin\AppData\Local\Temp\2879.tmp"95⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\28E6.tmp"C:\Users\Admin\AppData\Local\Temp\28E6.tmp"96⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2963.tmp"C:\Users\Admin\AppData\Local\Temp\2963.tmp"97⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\29FF.tmp"C:\Users\Admin\AppData\Local\Temp\29FF.tmp"98⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"99⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\2B76.tmp"C:\Users\Admin\AppData\Local\Temp\2B76.tmp"101⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"102⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\2C70.tmp"C:\Users\Admin\AppData\Local\Temp\2C70.tmp"103⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\2CFD.tmp"C:\Users\Admin\AppData\Local\Temp\2CFD.tmp"104⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"105⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\2DF7.tmp"C:\Users\Admin\AppData\Local\Temp\2DF7.tmp"106⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\2E93.tmp"C:\Users\Admin\AppData\Local\Temp\2E93.tmp"107⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\2F10.tmp"C:\Users\Admin\AppData\Local\Temp\2F10.tmp"108⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"109⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\3029.tmp"C:\Users\Admin\AppData\Local\Temp\3029.tmp"110⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\30D5.tmp"C:\Users\Admin\AppData\Local\Temp\30D5.tmp"111⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\3162.tmp"C:\Users\Admin\AppData\Local\Temp\3162.tmp"112⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\31DF.tmp"C:\Users\Admin\AppData\Local\Temp\31DF.tmp"113⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\325C.tmp"C:\Users\Admin\AppData\Local\Temp\325C.tmp"114⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\32E8.tmp"C:\Users\Admin\AppData\Local\Temp\32E8.tmp"115⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\3365.tmp"C:\Users\Admin\AppData\Local\Temp\3365.tmp"116⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\33D3.tmp"C:\Users\Admin\AppData\Local\Temp\33D3.tmp"117⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\347F.tmp"C:\Users\Admin\AppData\Local\Temp\347F.tmp"118⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\34FC.tmp"C:\Users\Admin\AppData\Local\Temp\34FC.tmp"119⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\3579.tmp"C:\Users\Admin\AppData\Local\Temp\3579.tmp"120⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\35E6.tmp"C:\Users\Admin\AppData\Local\Temp\35E6.tmp"121⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\3673.tmp"C:\Users\Admin\AppData\Local\Temp\3673.tmp"122⤵PID:1928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-