Analysis
- max time kernel
132s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_de401a927ec373846fa6878567bb1533_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_de401a927ec373846fa6878567bb1533_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-27_de401a927ec373846fa6878567bb1533_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260828-e2r2masycx
- SHA256 e8a0c8b0075d4560e6952a30d775340baf101488992a9a98db3f494a5a83f809
- MD5 de401a927ec373846fa6878567bb1533
- SHA1 09119d8850c9d2d5f80180f3adaa94dd6356b0bf
- SHA512 35354a51fee94d9dc8cba394ddd8c5f3eb05ac0d914645308d93f7d0d131a351e136c79064606e98bcad352f10efa55e8444aad722f1d0ad82739989fec38443
- SSDEEP 12288:9U5rCOTei683p2fq/XIg91BPERqeqZoXWjdq:9UQOJ68Z2fq/J1BM4eqqGh
- TLSH T1C0C4F125B584C036E69211314EE6EBB2693E7D315B2660CB7BC0736E6FB12E1A374317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3760 BB09.tmp 5228 BBD4.tmp 5128 BCAF.tmp 4600 BD5B.tmp 3444 BE35.tmp 4684 BEE1.tmp 840 BF9D.tmp 2804 C00A.tmp 3324 C078.tmp 1280 C133.tmp 3316 C1C0.tmp 5088 C24C.tmp 4100 C317.tmp 4300 C3A4.tmp 4140 C460.tmp 5012 C51B.tmp 5272 C5B7.tmp 4608 C625.tmp 5704 C6B1.tmp 1484 C73E.tmp 2120 C7F9.tmp 3376 C8C5.tmp 1976 C99F.tmp 1120 CA4B.tmp 4772 CAE7.tmp 1580 CB64.tmp 3040 CC10.tmp 4588 CC8D.tmp 2448 CD87.tmp 2980 CE14.tmp 708 CEFE.tmp 4740 CF7B.tmp 1752 D008.tmp 5296 D095.tmp 6068 D102.tmp 4080 D18F.tmp 5556 D21B.tmp 1316 D2A8.tmp 1880 D315.tmp 4448 D383.tmp 4816 D400.tmp 2940 D49C.tmp 3336 D519.tmp 1332 D596.tmp 5928 D603.tmp 2716 D680.tmp 1648 D6FD.tmp 4244 D77A.tmp 5364 D7E8.tmp 1928 D893.tmp 1304 D910.tmp 2156 D97E.tmp 2504 D9EB.tmp 3996 DA59.tmp 2372 DAC6.tmp 2076 DB33.tmp 2036 DBA1.tmp 4236 DC2D.tmp 5784 DC9B.tmp 304 DD27.tmp 244 DDA4.tmp 484 DE12.tmp 5096 DE8F.tmp 2840 DEFC.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8624.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E139.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9324.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D97E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 471C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A499.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 130C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E70B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2353.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 319C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 601E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1866.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C00A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4564 wrote to memory of 3760 4564 2026-08-27_de401a927ec373846fa6878567bb1533_elex_mafia_stealc_tofsee.exe 88 PID 3760 wrote to memory of 5228 3760 BB09.tmp 89 PID 5228 wrote to memory of 5128 5228 BBD4.tmp 90 PID 5128 wrote to memory of 4600 5128 BCAF.tmp 91 PID 4600 wrote to memory of 3444 4600 BD5B.tmp 92 PID 3444 wrote to memory of 4684 3444 BE35.tmp 93 PID 4684 wrote to memory of 840 4684 BEE1.tmp 94 PID 840 wrote to memory of 2804 840 BF9D.tmp 95 PID 2804 wrote to memory of 3324 2804 C00A.tmp 96 PID 3324 wrote to memory of 1280 3324 C078.tmp 97 PID 1280 wrote to memory of 3316 1280 C133.tmp 98 PID 3316 wrote to memory of 5088 3316 C1C0.tmp 99 PID 5088 wrote to memory of 4100 5088 C24C.tmp 100 PID 4100 wrote to memory of 4300 4100 C317.tmp 101 PID 4300 wrote to memory of 4140 4300 C3A4.tmp 102 PID 4140 wrote to memory of 5012 4140 C460.tmp 103 PID 5012 wrote to memory of 5272 5012 C51B.tmp 104 PID 5272 wrote to memory of 4608 5272 C5B7.tmp 105 PID 4608 wrote to memory of 5704 4608 C625.tmp 106 PID 5704 wrote to memory of 1484 5704 C6B1.tmp 107 PID 1484 wrote to memory of 2120 1484 C73E.tmp 108 PID 2120 wrote to memory of 3376 2120 C7F9.tmp 109 PID 3376 wrote to memory of 1976 3376 C8C5.tmp 110 PID 1976 wrote to memory of 1120 1976 C99F.tmp 111 PID 1120 wrote to memory of 4772 1120 CA4B.tmp 112 PID 4772 wrote to memory of 1580 4772 CAE7.tmp 113 PID 1580 wrote to memory of 3040 1580 CB64.tmp 114 PID 3040 wrote to memory of 4588 3040 CC10.tmp 115 PID 4588 wrote to memory of 2448 4588 CC8D.tmp 116 PID 2448 wrote to memory of 2980 2448 CD87.tmp 117 PID 2980 wrote to memory of 708 2980 CE14.tmp 118 PID 708 wrote to memory of 4740 708 CEFE.tmp 119 PID 4740 wrote to memory of 1752 4740 CF7B.tmp 120 PID 1752 wrote to memory of 5296 1752 D008.tmp 121 PID 5296 wrote to memory of 6068 5296 D095.tmp 122 PID 6068 wrote to memory of 4080 6068 D102.tmp 123 PID 4080 wrote to memory of 5556 4080 D18F.tmp 124 PID 5556 wrote to memory of 1316 5556 D21B.tmp 125 PID 1316 wrote to memory of 1880 1316 D2A8.tmp 126 PID 1880 wrote to memory of 4448 1880 D315.tmp 127 PID 4448 wrote to memory of 4816 4448 D383.tmp 128 PID 4816 wrote to memory of 2940 4816 D400.tmp 129 PID 2940 wrote to memory of 3336 2940 D49C.tmp 130 PID 3336 wrote to memory of 1332 3336 D519.tmp 131 PID 1332 wrote to memory of 5928 1332 D596.tmp 132 PID 5928 wrote to memory of 2716 5928 D603.tmp 133 PID 2716 wrote to memory of 1648 2716 D680.tmp 134 PID 1648 wrote to memory of 4244 1648 D6FD.tmp 135 PID 4244 wrote to memory of 5364 4244 D77A.tmp 136 PID 5364 wrote to memory of 1928 5364 D7E8.tmp 137 PID 1928 wrote to memory of 1304 1928 D893.tmp 138 PID 1304 wrote to memory of 2156 1304 D910.tmp 139 PID 2156 wrote to memory of 2504 2156 D97E.tmp 140 PID 2504 wrote to memory of 3996 2504 D9EB.tmp 141 PID 3996 wrote to memory of 2372 3996 DA59.tmp 142 PID 2372 wrote to memory of 2076 2372 DAC6.tmp 143 PID 2076 wrote to memory of 2036 2076 DB33.tmp 144 PID 2036 wrote to memory of 4236 2036 DBA1.tmp 145 PID 4236 wrote to memory of 5784 4236 DC2D.tmp 146 PID 5784 wrote to memory of 304 5784 DC9B.tmp 147 PID 304 wrote to memory of 244 304 DD27.tmp 148 PID 244 wrote to memory of 484 244 DDA4.tmp 149 PID 484 wrote to memory of 5096 484 DE12.tmp 150 PID 5096 wrote to memory of 2840 5096 DE8F.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_de401a927ec373846fa6878567bb1533_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_de401a927ec373846fa6878567bb1533_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\BB09.tmp"C:\Users\Admin\AppData\Local\Temp\BB09.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\BE35.tmp"C:\Users\Admin\AppData\Local\Temp\BE35.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\C00A.tmp"C:\Users\Admin\AppData\Local\Temp\C00A.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\C078.tmp"C:\Users\Admin\AppData\Local\Temp\C078.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\C133.tmp"C:\Users\Admin\AppData\Local\Temp\C133.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\C317.tmp"C:\Users\Admin\AppData\Local\Temp\C317.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\C460.tmp"C:\Users\Admin\AppData\Local\Temp\C460.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\C51B.tmp"C:\Users\Admin\AppData\Local\Temp\C51B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\C625.tmp"C:\Users\Admin\AppData\Local\Temp\C625.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\C73E.tmp"C:\Users\Admin\AppData\Local\Temp\C73E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\C99F.tmp"C:\Users\Admin\AppData\Local\Temp\C99F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\CB64.tmp"C:\Users\Admin\AppData\Local\Temp\CB64.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\CC10.tmp"C:\Users\Admin\AppData\Local\Temp\CC10.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\CD87.tmp"C:\Users\Admin\AppData\Local\Temp\CD87.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\CE14.tmp"C:\Users\Admin\AppData\Local\Temp\CE14.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\D095.tmp"C:\Users\Admin\AppData\Local\Temp\D095.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\D102.tmp"C:\Users\Admin\AppData\Local\Temp\D102.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\D18F.tmp"C:\Users\Admin\AppData\Local\Temp\D18F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\D21B.tmp"C:\Users\Admin\AppData\Local\Temp\D21B.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\D315.tmp"C:\Users\Admin\AppData\Local\Temp\D315.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\D383.tmp"C:\Users\Admin\AppData\Local\Temp\D383.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\D400.tmp"C:\Users\Admin\AppData\Local\Temp\D400.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\D49C.tmp"C:\Users\Admin\AppData\Local\Temp\D49C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\D519.tmp"C:\Users\Admin\AppData\Local\Temp\D519.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\D596.tmp"C:\Users\Admin\AppData\Local\Temp\D596.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\D603.tmp"C:\Users\Admin\AppData\Local\Temp\D603.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\D680.tmp"C:\Users\Admin\AppData\Local\Temp\D680.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\D77A.tmp"C:\Users\Admin\AppData\Local\Temp\D77A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\D97E.tmp"C:\Users\Admin\AppData\Local\Temp\D97E.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\DA59.tmp"C:\Users\Admin\AppData\Local\Temp\DA59.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\DB33.tmp"C:\Users\Admin\AppData\Local\Temp\DB33.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\DBA1.tmp"C:\Users\Admin\AppData\Local\Temp\DBA1.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\DD27.tmp"C:\Users\Admin\AppData\Local\Temp\DD27.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\DE12.tmp"C:\Users\Admin\AppData\Local\Temp\DE12.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"65⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\DF79.tmp"C:\Users\Admin\AppData\Local\Temp\DF79.tmp"66⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"67⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\E092.tmp"C:\Users\Admin\AppData\Local\Temp\E092.tmp"68⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\E10F.tmp"C:\Users\Admin\AppData\Local\Temp\E10F.tmp"69⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\E18C.tmp"C:\Users\Admin\AppData\Local\Temp\E18C.tmp"70⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\E209.tmp"C:\Users\Admin\AppData\Local\Temp\E209.tmp"71⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\E286.tmp"C:\Users\Admin\AppData\Local\Temp\E286.tmp"72⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\E313.tmp"C:\Users\Admin\AppData\Local\Temp\E313.tmp"73⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\E390.tmp"C:\Users\Admin\AppData\Local\Temp\E390.tmp"74⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"75⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\E47A.tmp"C:\Users\Admin\AppData\Local\Temp\E47A.tmp"76⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"77⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\E565.tmp"C:\Users\Admin\AppData\Local\Temp\E565.tmp"78⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"79⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\E66E.tmp"C:\Users\Admin\AppData\Local\Temp\E66E.tmp"80⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\E70B.tmp"C:\Users\Admin\AppData\Local\Temp\E70B.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\E788.tmp"C:\Users\Admin\AppData\Local\Temp\E788.tmp"82⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\E805.tmp"C:\Users\Admin\AppData\Local\Temp\E805.tmp"83⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"84⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"85⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\E97C.tmp"C:\Users\Admin\AppData\Local\Temp\E97C.tmp"86⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\EA18.tmp"C:\Users\Admin\AppData\Local\Temp\EA18.tmp"87⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"88⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\EB21.tmp"C:\Users\Admin\AppData\Local\Temp\EB21.tmp"89⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"90⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"91⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\EC89.tmp"C:\Users\Admin\AppData\Local\Temp\EC89.tmp"92⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"93⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\ED64.tmp"C:\Users\Admin\AppData\Local\Temp\ED64.tmp"94⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"95⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\EE3E.tmp"C:\Users\Admin\AppData\Local\Temp\EE3E.tmp"96⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"97⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\EF29.tmp"C:\Users\Admin\AppData\Local\Temp\EF29.tmp"98⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"99⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\F032.tmp"C:\Users\Admin\AppData\Local\Temp\F032.tmp"100⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"101⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\F16B.tmp"C:\Users\Admin\AppData\Local\Temp\F16B.tmp"102⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"103⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\F284.tmp"C:\Users\Admin\AppData\Local\Temp\F284.tmp"104⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\F311.tmp"C:\Users\Admin\AppData\Local\Temp\F311.tmp"105⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\F36E.tmp"C:\Users\Admin\AppData\Local\Temp\F36E.tmp"106⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"107⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\F459.tmp"C:\Users\Admin\AppData\Local\Temp\F459.tmp"108⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"109⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"110⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"111⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\F63D.tmp"C:\Users\Admin\AppData\Local\Temp\F63D.tmp"112⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\F6BA.tmp"C:\Users\Admin\AppData\Local\Temp\F6BA.tmp"113⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\F747.tmp"C:\Users\Admin\AppData\Local\Temp\F747.tmp"114⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"115⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\F831.tmp"C:\Users\Admin\AppData\Local\Temp\F831.tmp"116⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"117⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\F93B.tmp"C:\Users\Admin\AppData\Local\Temp\F93B.tmp"118⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"119⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\FA54.tmp"C:\Users\Admin\AppData\Local\Temp\FA54.tmp"120⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\FAD1.tmp"C:\Users\Admin\AppData\Local\Temp\FAD1.tmp"121⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"122⤵PID:4576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-