Analysis
- max time kernel
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_de5cd6d2af4408d6a7c6e2f1e96b3635_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_de5cd6d2af4408d6a7c6e2f1e96b3635_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-27_de5cd6d2af4408d6a7c6e2f1e96b3635_elex_mafia_stealc_tofsee.exe
- Size 541KB
- Sample260828-e196tasyct
- SHA256 f64ea03a35e6bb15130021b7cfa02f12c692e2b787577422175f16182633a093
- MD5 de5cd6d2af4408d6a7c6e2f1e96b3635
- SHA1 7e368c6444fd1bff3d1a35d11815bdd47b48104c
- SHA512 2884ae3d81c784848072dceff8cc64ce85001d43e354223056cf20448417e5713b658a19e6ec4fd3a8e1545470cf4f1c7fc4c54e49f3f975b244e08afb0deee3
- SSDEEP 12288:HU5rCOTeiJW+MIY+zIC7dZc+/LVMBNZb73ctO:HUQOJJWZIY+zZ7dZc+/LSBNV73ctO
- TLSH T1B9C4E115B5458233D6C202310BD6DBF22A3BBD75572694C33B94A63E2BB27E0E3B5346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4428 323.tmp 4460 3CF.tmp 3272 43C.tmp 1280 4E8.tmp 6048 5A3.tmp 4468 759.tmp 924 7F5.tmp 2560 8B1.tmp 4876 95D.tmp 5548 9DA.tmp 2000 A76.tmp 4160 B02.tmp 1108 BCE.tmp 1596 C99.tmp 4956 D45.tmp 4884 E00.tmp 1240 E8D.tmp 2360 F48.tmp 4376 1004.tmp 4512 1081.tmp 3424 111D.tmp 252 119A.tmp 3380 1217.tmp 5112 12D2.tmp 5820 139E.tmp 5736 141B.tmp 4472 14A7.tmp 4148 1563.tmp 596 163D.tmp 5668 1709.tmp 1056 17A5.tmp 3228 1870.tmp 5828 193B.tmp 5740 19A8.tmp 1692 1A16.tmp 4456 1A93.tmp 5960 1B10.tmp 1156 1B8D.tmp 5376 1C0A.tmp 3744 1C87.tmp 4316 1D04.tmp 3544 1D71.tmp 5972 1DEE.tmp 4408 1E6B.tmp 2736 1F07.tmp 1620 1F75.tmp 3340 1FF2.tmp 4412 206F.tmp 1568 20DC.tmp 1628 2169.tmp 2456 21C7.tmp 1324 2253.tmp 5632 22C1.tmp 1328 235D.tmp 2488 23DA.tmp 6004 2447.tmp 1248 24D4.tmp 4268 2551.tmp 632 25ED.tmp 2272 266A.tmp 2484 2716.tmp 3240 27A3.tmp 6076 2820.tmp 5512 288D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B462.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A83C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5877.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D39D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C45B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 193B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 141B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C29A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2685.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B03B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 892B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 665C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7390.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81C4.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4660 wrote to memory of 4428 4660 2026-08-27_de5cd6d2af4408d6a7c6e2f1e96b3635_elex_mafia_stealc_tofsee.exe 89 PID 4428 wrote to memory of 4460 4428 323.tmp 90 PID 4460 wrote to memory of 3272 4460 3CF.tmp 91 PID 3272 wrote to memory of 1280 3272 43C.tmp 92 PID 1280 wrote to memory of 6048 1280 4E8.tmp 93 PID 6048 wrote to memory of 4468 6048 5A3.tmp 94 PID 4468 wrote to memory of 924 4468 759.tmp 95 PID 924 wrote to memory of 2560 924 7F5.tmp 96 PID 2560 wrote to memory of 4876 2560 8B1.tmp 97 PID 4876 wrote to memory of 5548 4876 95D.tmp 98 PID 5548 wrote to memory of 2000 5548 9DA.tmp 99 PID 2000 wrote to memory of 4160 2000 A76.tmp 100 PID 4160 wrote to memory of 1108 4160 B02.tmp 101 PID 1108 wrote to memory of 1596 1108 BCE.tmp 102 PID 1596 wrote to memory of 4956 1596 C99.tmp 103 PID 4956 wrote to memory of 4884 4956 D45.tmp 104 PID 4884 wrote to memory of 1240 4884 E00.tmp 105 PID 1240 wrote to memory of 2360 1240 E8D.tmp 106 PID 2360 wrote to memory of 4376 2360 F48.tmp 107 PID 4376 wrote to memory of 4512 4376 1004.tmp 108 PID 4512 wrote to memory of 3424 4512 1081.tmp 109 PID 3424 wrote to memory of 252 3424 111D.tmp 110 PID 252 wrote to memory of 3380 252 119A.tmp 111 PID 3380 wrote to memory of 5112 3380 1217.tmp 112 PID 5112 wrote to memory of 5820 5112 12D2.tmp 113 PID 5820 wrote to memory of 5736 5820 139E.tmp 114 PID 5736 wrote to memory of 4472 5736 141B.tmp 115 PID 4472 wrote to memory of 4148 4472 14A7.tmp 116 PID 4148 wrote to memory of 596 4148 1563.tmp 117 PID 596 wrote to memory of 5668 596 163D.tmp 118 PID 5668 wrote to memory of 1056 5668 1709.tmp 119 PID 1056 wrote to memory of 3228 1056 17A5.tmp 120 PID 3228 wrote to memory of 5828 3228 1870.tmp 121 PID 5828 wrote to memory of 5740 5828 193B.tmp 122 PID 5740 wrote to memory of 1692 5740 19A8.tmp 123 PID 1692 wrote to memory of 4456 1692 1A16.tmp 124 PID 4456 wrote to memory of 5960 4456 1A93.tmp 125 PID 5960 wrote to memory of 1156 5960 1B10.tmp 126 PID 1156 wrote to memory of 5376 1156 1B8D.tmp 127 PID 5376 wrote to memory of 3744 5376 1C0A.tmp 128 PID 3744 wrote to memory of 4316 3744 1C87.tmp 129 PID 4316 wrote to memory of 3544 4316 1D04.tmp 130 PID 3544 wrote to memory of 5972 3544 1D71.tmp 131 PID 5972 wrote to memory of 4408 5972 1DEE.tmp 132 PID 4408 wrote to memory of 2736 4408 1E6B.tmp 133 PID 2736 wrote to memory of 1620 2736 1F07.tmp 134 PID 1620 wrote to memory of 3340 1620 1F75.tmp 135 PID 3340 wrote to memory of 4412 3340 1FF2.tmp 136 PID 4412 wrote to memory of 1568 4412 206F.tmp 137 PID 1568 wrote to memory of 1628 1568 20DC.tmp 138 PID 1628 wrote to memory of 2456 1628 2169.tmp 139 PID 2456 wrote to memory of 1324 2456 21C7.tmp 140 PID 1324 wrote to memory of 5632 1324 2253.tmp 141 PID 5632 wrote to memory of 1328 5632 22C1.tmp 142 PID 1328 wrote to memory of 2488 1328 235D.tmp 143 PID 2488 wrote to memory of 6004 2488 23DA.tmp 144 PID 6004 wrote to memory of 1248 6004 2447.tmp 145 PID 1248 wrote to memory of 4268 1248 24D4.tmp 146 PID 4268 wrote to memory of 632 4268 2551.tmp 147 PID 632 wrote to memory of 2272 632 25ED.tmp 148 PID 2272 wrote to memory of 2484 2272 266A.tmp 149 PID 2484 wrote to memory of 3240 2484 2716.tmp 150 PID 3240 wrote to memory of 6076 3240 27A3.tmp 151 PID 6076 wrote to memory of 5512 6076 2820.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_de5cd6d2af4408d6a7c6e2f1e96b3635_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_de5cd6d2af4408d6a7c6e2f1e96b3635_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\323.tmp"C:\Users\Admin\AppData\Local\Temp\323.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\3CF.tmp"C:\Users\Admin\AppData\Local\Temp\3CF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\43C.tmp"C:\Users\Admin\AppData\Local\Temp\43C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\4E8.tmp"C:\Users\Admin\AppData\Local\Temp\4E8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\5A3.tmp"C:\Users\Admin\AppData\Local\Temp\5A3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\759.tmp"C:\Users\Admin\AppData\Local\Temp\759.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\7F5.tmp"C:\Users\Admin\AppData\Local\Temp\7F5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\8B1.tmp"C:\Users\Admin\AppData\Local\Temp\8B1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\95D.tmp"C:\Users\Admin\AppData\Local\Temp\95D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9DA.tmp"C:\Users\Admin\AppData\Local\Temp\9DA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\A76.tmp"C:\Users\Admin\AppData\Local\Temp\A76.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\B02.tmp"C:\Users\Admin\AppData\Local\Temp\B02.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\BCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\C99.tmp"C:\Users\Admin\AppData\Local\Temp\C99.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\D45.tmp"C:\Users\Admin\AppData\Local\Temp\D45.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\E00.tmp"C:\Users\Admin\AppData\Local\Temp\E00.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\E8D.tmp"C:\Users\Admin\AppData\Local\Temp\E8D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\F48.tmp"C:\Users\Admin\AppData\Local\Temp\F48.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\1004.tmp"C:\Users\Admin\AppData\Local\Temp\1004.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\1081.tmp"C:\Users\Admin\AppData\Local\Temp\1081.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\111D.tmp"C:\Users\Admin\AppData\Local\Temp\111D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\119A.tmp"C:\Users\Admin\AppData\Local\Temp\119A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\1217.tmp"C:\Users\Admin\AppData\Local\Temp\1217.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\12D2.tmp"C:\Users\Admin\AppData\Local\Temp\12D2.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\139E.tmp"C:\Users\Admin\AppData\Local\Temp\139E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\141B.tmp"C:\Users\Admin\AppData\Local\Temp\141B.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\14A7.tmp"C:\Users\Admin\AppData\Local\Temp\14A7.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\1563.tmp"C:\Users\Admin\AppData\Local\Temp\1563.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\163D.tmp"C:\Users\Admin\AppData\Local\Temp\163D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\1709.tmp"C:\Users\Admin\AppData\Local\Temp\1709.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\17A5.tmp"C:\Users\Admin\AppData\Local\Temp\17A5.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1A93.tmp"C:\Users\Admin\AppData\Local\Temp\1A93.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\1B10.tmp"C:\Users\Admin\AppData\Local\Temp\1B10.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\1C87.tmp"C:\Users\Admin\AppData\Local\Temp\1C87.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\1D04.tmp"C:\Users\Admin\AppData\Local\Temp\1D04.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\1D71.tmp"C:\Users\Admin\AppData\Local\Temp\1D71.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\1F07.tmp"C:\Users\Admin\AppData\Local\Temp\1F07.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\206F.tmp"C:\Users\Admin\AppData\Local\Temp\206F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\20DC.tmp"C:\Users\Admin\AppData\Local\Temp\20DC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\2169.tmp"C:\Users\Admin\AppData\Local\Temp\2169.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\2253.tmp"C:\Users\Admin\AppData\Local\Temp\2253.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\22C1.tmp"C:\Users\Admin\AppData\Local\Temp\22C1.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\235D.tmp"C:\Users\Admin\AppData\Local\Temp\235D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\23DA.tmp"C:\Users\Admin\AppData\Local\Temp\23DA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\2447.tmp"C:\Users\Admin\AppData\Local\Temp\2447.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\24D4.tmp"C:\Users\Admin\AppData\Local\Temp\24D4.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\2551.tmp"C:\Users\Admin\AppData\Local\Temp\2551.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\25ED.tmp"C:\Users\Admin\AppData\Local\Temp\25ED.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\266A.tmp"C:\Users\Admin\AppData\Local\Temp\266A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\2716.tmp"C:\Users\Admin\AppData\Local\Temp\2716.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\27A3.tmp"C:\Users\Admin\AppData\Local\Temp\27A3.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\288D.tmp"C:\Users\Admin\AppData\Local\Temp\288D.tmp"65⤵
- Executes dropped EXE
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\290A.tmp"C:\Users\Admin\AppData\Local\Temp\290A.tmp"66⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2997.tmp"C:\Users\Admin\AppData\Local\Temp\2997.tmp"67⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\2A23.tmp"C:\Users\Admin\AppData\Local\Temp\2A23.tmp"68⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"69⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\2B5C.tmp"C:\Users\Admin\AppData\Local\Temp\2B5C.tmp"70⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2BD9.tmp"C:\Users\Admin\AppData\Local\Temp\2BD9.tmp"71⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\2C36.tmp"C:\Users\Admin\AppData\Local\Temp\2C36.tmp"72⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"73⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\2D30.tmp"C:\Users\Admin\AppData\Local\Temp\2D30.tmp"74⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"75⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"76⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\2E98.tmp"C:\Users\Admin\AppData\Local\Temp\2E98.tmp"77⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\2F15.tmp"C:\Users\Admin\AppData\Local\Temp\2F15.tmp"78⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"79⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\302E.tmp"C:\Users\Admin\AppData\Local\Temp\302E.tmp"80⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\30AB.tmp"C:\Users\Admin\AppData\Local\Temp\30AB.tmp"81⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\3138.tmp"C:\Users\Admin\AppData\Local\Temp\3138.tmp"82⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\31D4.tmp"C:\Users\Admin\AppData\Local\Temp\31D4.tmp"83⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\3241.tmp"C:\Users\Admin\AppData\Local\Temp\3241.tmp"84⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\32BE.tmp"C:\Users\Admin\AppData\Local\Temp\32BE.tmp"85⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\333B.tmp"C:\Users\Admin\AppData\Local\Temp\333B.tmp"86⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\33A9.tmp"C:\Users\Admin\AppData\Local\Temp\33A9.tmp"87⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3426.tmp"C:\Users\Admin\AppData\Local\Temp\3426.tmp"88⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\34B2.tmp"C:\Users\Admin\AppData\Local\Temp\34B2.tmp"89⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\3520.tmp"C:\Users\Admin\AppData\Local\Temp\3520.tmp"90⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\357D.tmp"C:\Users\Admin\AppData\Local\Temp\357D.tmp"91⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\35FA.tmp"C:\Users\Admin\AppData\Local\Temp\35FA.tmp"92⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\3668.tmp"C:\Users\Admin\AppData\Local\Temp\3668.tmp"93⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\36E5.tmp"C:\Users\Admin\AppData\Local\Temp\36E5.tmp"94⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\3752.tmp"C:\Users\Admin\AppData\Local\Temp\3752.tmp"95⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"96⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\384C.tmp"C:\Users\Admin\AppData\Local\Temp\384C.tmp"97⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\38D9.tmp"C:\Users\Admin\AppData\Local\Temp\38D9.tmp"98⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"99⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\39E2.tmp"C:\Users\Admin\AppData\Local\Temp\39E2.tmp"100⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"101⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"102⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3B59.tmp"C:\Users\Admin\AppData\Local\Temp\3B59.tmp"103⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\3BD6.tmp"C:\Users\Admin\AppData\Local\Temp\3BD6.tmp"104⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\3C63.tmp"C:\Users\Admin\AppData\Local\Temp\3C63.tmp"105⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"106⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"107⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"108⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"109⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"110⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"111⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"112⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"113⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"114⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\40F7.tmp"C:\Users\Admin\AppData\Local\Temp\40F7.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"116⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\4201.tmp"C:\Users\Admin\AppData\Local\Temp\4201.tmp"117⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\428D.tmp"C:\Users\Admin\AppData\Local\Temp\428D.tmp"118⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\42FB.tmp"C:\Users\Admin\AppData\Local\Temp\42FB.tmp"119⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\4378.tmp"C:\Users\Admin\AppData\Local\Temp\4378.tmp"120⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\4404.tmp"C:\Users\Admin\AppData\Local\Temp\4404.tmp"121⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\4472.tmp"C:\Users\Admin\AppData\Local\Temp\4472.tmp"122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-