Analysis
- max time kernel
130s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 13:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-01_3abdbd4ae0bb3a1f251d95764e307d6d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-01_3abdbd4ae0bb3a1f251d95764e307d6d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-09-01_3abdbd4ae0bb3a1f251d95764e307d6d_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260903-qs9e4atzcx
- SHA256 f7252e112cf1fc9bf0907f781548f7d01b49e5992147dfa531c9eecb84a5f93a
- MD5 3abdbd4ae0bb3a1f251d95764e307d6d
- SHA1 de5113bb05c7d934f85e8be04fcb3ada1052f4a8
- SHA512 464316e20737d493e4e8cc28e63ffe3ada93581b79641bba8c12f06ed478103e9c22b02c3901f64ed54f839b0ae3d4660a03ed6781adaa8072fef8bd260b09f4
- SSDEEP 12288:9U5rCOTei6poBuFr4BFFCcxlVg5JAJt9eSQXFwXqZoXWjdqpby1grA70G+o:9UQOJ6poBjICVg569BQXaXqqGh4yATXo
- TLSH T1F7E401217985C032F5D212348FE2EBB1297ABD71572264C77B84676E6FB02E19738347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3428 C464.tmp 5068 C54F.tmp 2008 C649.tmp 5972 C772.tmp 1860 C82D.tmp 3604 C8F8.tmp 2188 C9B4.tmp 3040 CADD.tmp 4368 CBD7.tmp 2448 CC73.tmp 5112 CD5D.tmp 5100 CE19.tmp 4508 CEC5.tmp 1520 CFAF.tmp 4560 D08A.tmp 124 D126.tmp 3912 D1B3.tmp 4860 D26E.tmp 1344 D31A.tmp 1880 D3A7.tmp 3460 D481.tmp 5668 D54C.tmp 1672 D608.tmp 1040 D6C3.tmp 5288 D78F.tmp 4736 D84A.tmp 5304 D915.tmp 3152 D992.tmp 4856 DA6D.tmp 4892 DAEA.tmp 2176 DB86.tmp 2568 DC42.tmp 3300 DCFD.tmp 2420 DD8A.tmp 4780 DE07.tmp 4588 DEA3.tmp 796 DF4F.tmp 5228 DFCC.tmp 4704 E059.tmp 4316 E0D6.tmp 5900 E162.tmp 5384 E1D0.tmp 2928 E26C.tmp 1496 E2E9.tmp 4528 E375.tmp 1480 E3F2.tmp 4640 E47F.tmp 1600 E51B.tmp 5596 E5A8.tmp 2868 E625.tmp 5816 E6C1.tmp 4612 E76D.tmp 2860 E7DA.tmp 2676 E857.tmp 4684 E8F4.tmp 5460 E971.tmp 4816 E9EE.tmp 1980 EA5B.tmp 4592 EAC8.tmp 3264 EB65.tmp 2724 EBD2.tmp 2720 EC6E.tmp 5860 ECFB.tmp 3712 ED78.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B576.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 572E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C23D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A21D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2438.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 280B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8389.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 937C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B82B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 323.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 193B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 636E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 923F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B58B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAC8.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4620 wrote to memory of 3428 4620 2026-09-01_3abdbd4ae0bb3a1f251d95764e307d6d_elex_mafia_stealc_tofsee.exe 89 PID 3428 wrote to memory of 5068 3428 C464.tmp 90 PID 5068 wrote to memory of 2008 5068 C54F.tmp 91 PID 2008 wrote to memory of 5972 2008 C649.tmp 92 PID 5972 wrote to memory of 1860 5972 C772.tmp 93 PID 1860 wrote to memory of 3604 1860 C82D.tmp 94 PID 3604 wrote to memory of 2188 3604 C8F8.tmp 95 PID 2188 wrote to memory of 3040 2188 C9B4.tmp 96 PID 3040 wrote to memory of 4368 3040 CADD.tmp 97 PID 4368 wrote to memory of 2448 4368 CBD7.tmp 98 PID 2448 wrote to memory of 5112 2448 CC73.tmp 99 PID 5112 wrote to memory of 5100 5112 CD5D.tmp 100 PID 5100 wrote to memory of 4508 5100 CE19.tmp 101 PID 4508 wrote to memory of 1520 4508 CEC5.tmp 102 PID 1520 wrote to memory of 4560 1520 CFAF.tmp 103 PID 4560 wrote to memory of 124 4560 D08A.tmp 104 PID 124 wrote to memory of 3912 124 D126.tmp 105 PID 3912 wrote to memory of 4860 3912 D1B3.tmp 106 PID 4860 wrote to memory of 1344 4860 D26E.tmp 107 PID 1344 wrote to memory of 1880 1344 D31A.tmp 108 PID 1880 wrote to memory of 3460 1880 D3A7.tmp 109 PID 3460 wrote to memory of 5668 3460 D481.tmp 110 PID 5668 wrote to memory of 1672 5668 D54C.tmp 111 PID 1672 wrote to memory of 1040 1672 D608.tmp 112 PID 1040 wrote to memory of 5288 1040 D6C3.tmp 113 PID 5288 wrote to memory of 4736 5288 D78F.tmp 114 PID 4736 wrote to memory of 5304 4736 D84A.tmp 115 PID 5304 wrote to memory of 3152 5304 D915.tmp 116 PID 3152 wrote to memory of 4856 3152 D992.tmp 117 PID 4856 wrote to memory of 4892 4856 DA6D.tmp 118 PID 4892 wrote to memory of 2176 4892 DAEA.tmp 119 PID 2176 wrote to memory of 2568 2176 DB86.tmp 120 PID 2568 wrote to memory of 3300 2568 DC42.tmp 121 PID 3300 wrote to memory of 2420 3300 DCFD.tmp 122 PID 2420 wrote to memory of 4780 2420 DD8A.tmp 123 PID 4780 wrote to memory of 4588 4780 DE07.tmp 124 PID 4588 wrote to memory of 796 4588 DEA3.tmp 125 PID 796 wrote to memory of 5228 796 DF4F.tmp 126 PID 5228 wrote to memory of 4704 5228 DFCC.tmp 127 PID 4704 wrote to memory of 4316 4704 E059.tmp 128 PID 4316 wrote to memory of 5900 4316 E0D6.tmp 129 PID 5900 wrote to memory of 5384 5900 E162.tmp 130 PID 5384 wrote to memory of 2928 5384 E1D0.tmp 131 PID 2928 wrote to memory of 1496 2928 E26C.tmp 132 PID 1496 wrote to memory of 4528 1496 E2E9.tmp 133 PID 4528 wrote to memory of 1480 4528 E375.tmp 134 PID 1480 wrote to memory of 4640 1480 E3F2.tmp 135 PID 4640 wrote to memory of 1600 4640 E47F.tmp 136 PID 1600 wrote to memory of 5596 1600 E51B.tmp 137 PID 5596 wrote to memory of 2868 5596 E5A8.tmp 138 PID 2868 wrote to memory of 5816 2868 E625.tmp 139 PID 5816 wrote to memory of 4612 5816 E6C1.tmp 140 PID 4612 wrote to memory of 2860 4612 E76D.tmp 141 PID 2860 wrote to memory of 2676 2860 E7DA.tmp 142 PID 2676 wrote to memory of 4684 2676 E857.tmp 143 PID 4684 wrote to memory of 5460 4684 E8F4.tmp 144 PID 5460 wrote to memory of 4816 5460 E971.tmp 145 PID 4816 wrote to memory of 1980 4816 E9EE.tmp 146 PID 1980 wrote to memory of 4592 1980 EA5B.tmp 147 PID 4592 wrote to memory of 3264 4592 EAC8.tmp 148 PID 3264 wrote to memory of 2724 3264 EB65.tmp 149 PID 2724 wrote to memory of 2720 2724 EBD2.tmp 150 PID 2720 wrote to memory of 5860 2720 EC6E.tmp 151 PID 5860 wrote to memory of 3712 5860 ECFB.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-01_3abdbd4ae0bb3a1f251d95764e307d6d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_3abdbd4ae0bb3a1f251d95764e307d6d_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\C464.tmp"C:\Users\Admin\AppData\Local\Temp\C464.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\C54F.tmp"C:\Users\Admin\AppData\Local\Temp\C54F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\C649.tmp"C:\Users\Admin\AppData\Local\Temp\C649.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\C772.tmp"C:\Users\Admin\AppData\Local\Temp\C772.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\C82D.tmp"C:\Users\Admin\AppData\Local\Temp\C82D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\CE19.tmp"C:\Users\Admin\AppData\Local\Temp\CE19.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\D08A.tmp"C:\Users\Admin\AppData\Local\Temp\D08A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\D126.tmp"C:\Users\Admin\AppData\Local\Temp\D126.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\D26E.tmp"C:\Users\Admin\AppData\Local\Temp\D26E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\D31A.tmp"C:\Users\Admin\AppData\Local\Temp\D31A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\D481.tmp"C:\Users\Admin\AppData\Local\Temp\D481.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\D54C.tmp"C:\Users\Admin\AppData\Local\Temp\D54C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\D608.tmp"C:\Users\Admin\AppData\Local\Temp\D608.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\D6C3.tmp"C:\Users\Admin\AppData\Local\Temp\D6C3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\D78F.tmp"C:\Users\Admin\AppData\Local\Temp\D78F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\D84A.tmp"C:\Users\Admin\AppData\Local\Temp\D84A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\D915.tmp"C:\Users\Admin\AppData\Local\Temp\D915.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\D992.tmp"C:\Users\Admin\AppData\Local\Temp\D992.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\DB86.tmp"C:\Users\Admin\AppData\Local\Temp\DB86.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\DC42.tmp"C:\Users\Admin\AppData\Local\Temp\DC42.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\DCFD.tmp"C:\Users\Admin\AppData\Local\Temp\DCFD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\DD8A.tmp"C:\Users\Admin\AppData\Local\Temp\DD8A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\DE07.tmp"C:\Users\Admin\AppData\Local\Temp\DE07.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\E059.tmp"C:\Users\Admin\AppData\Local\Temp\E059.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\E162.tmp"C:\Users\Admin\AppData\Local\Temp\E162.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\E26C.tmp"C:\Users\Admin\AppData\Local\Temp\E26C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\E2E9.tmp"C:\Users\Admin\AppData\Local\Temp\E2E9.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\E375.tmp"C:\Users\Admin\AppData\Local\Temp\E375.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\E3F2.tmp"C:\Users\Admin\AppData\Local\Temp\E3F2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\E47F.tmp"C:\Users\Admin\AppData\Local\Temp\E47F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\E51B.tmp"C:\Users\Admin\AppData\Local\Temp\E51B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\E625.tmp"C:\Users\Admin\AppData\Local\Temp\E625.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\E76D.tmp"C:\Users\Admin\AppData\Local\Temp\E76D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\E857.tmp"C:\Users\Admin\AppData\Local\Temp\E857.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\E8F4.tmp"C:\Users\Admin\AppData\Local\Temp\E8F4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\E971.tmp"C:\Users\Admin\AppData\Local\Temp\E971.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\E9EE.tmp"C:\Users\Admin\AppData\Local\Temp\E9EE.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\EB65.tmp"C:\Users\Admin\AppData\Local\Temp\EB65.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\ED78.tmp"C:\Users\Admin\AppData\Local\Temp\ED78.tmp"65⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\EE14.tmp"C:\Users\Admin\AppData\Local\Temp\EE14.tmp"66⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\EE82.tmp"C:\Users\Admin\AppData\Local\Temp\EE82.tmp"67⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\F018.tmp"C:\Users\Admin\AppData\Local\Temp\F018.tmp"70⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\F085.tmp"C:\Users\Admin\AppData\Local\Temp\F085.tmp"71⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\F102.tmp"C:\Users\Admin\AppData\Local\Temp\F102.tmp"72⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\F18F.tmp"C:\Users\Admin\AppData\Local\Temp\F18F.tmp"73⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"74⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\F298.tmp"C:\Users\Admin\AppData\Local\Temp\F298.tmp"75⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\F325.tmp"C:\Users\Admin\AppData\Local\Temp\F325.tmp"76⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"77⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\F44E.tmp"C:\Users\Admin\AppData\Local\Temp\F44E.tmp"78⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"79⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\F529.tmp"C:\Users\Admin\AppData\Local\Temp\F529.tmp"80⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\F5C5.tmp"C:\Users\Admin\AppData\Local\Temp\F5C5.tmp"81⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\F652.tmp"C:\Users\Admin\AppData\Local\Temp\F652.tmp"82⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"83⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\F75B.tmp"C:\Users\Admin\AppData\Local\Temp\F75B.tmp"84⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\F7D8.tmp"C:\Users\Admin\AppData\Local\Temp\F7D8.tmp"85⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\F855.tmp"C:\Users\Admin\AppData\Local\Temp\F855.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"87⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\F95F.tmp"C:\Users\Admin\AppData\Local\Temp\F95F.tmp"88⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"89⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\FA49.tmp"C:\Users\Admin\AppData\Local\Temp\FA49.tmp"90⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"91⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\FB82.tmp"C:\Users\Admin\AppData\Local\Temp\FB82.tmp"92⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"93⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"94⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\FD18.tmp"C:\Users\Admin\AppData\Local\Temp\FD18.tmp"95⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"96⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\FE22.tmp"C:\Users\Admin\AppData\Local\Temp\FE22.tmp"97⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"98⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"99⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\FF89.tmp"C:\Users\Admin\AppData\Local\Temp\FF89.tmp"100⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\6.tmp"C:\Users\Admin\AppData\Local\Temp\6.tmp"101⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\93.tmp"C:\Users\Admin\AppData\Local\Temp\93.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\12F.tmp"C:\Users\Admin\AppData\Local\Temp\12F.tmp"103⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\19C.tmp"C:\Users\Admin\AppData\Local\Temp\19C.tmp"104⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\238.tmp"C:\Users\Admin\AppData\Local\Temp\238.tmp"105⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\2B5.tmp"C:\Users\Admin\AppData\Local\Temp\2B5.tmp"106⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\323.tmp"C:\Users\Admin\AppData\Local\Temp\323.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\3BF.tmp"C:\Users\Admin\AppData\Local\Temp\3BF.tmp"108⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\44C.tmp"C:\Users\Admin\AppData\Local\Temp\44C.tmp"109⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\4D8.tmp"C:\Users\Admin\AppData\Local\Temp\4D8.tmp"110⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\584.tmp"C:\Users\Admin\AppData\Local\Temp\584.tmp"111⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\601.tmp"C:\Users\Admin\AppData\Local\Temp\601.tmp"112⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"113⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\71A.tmp"C:\Users\Admin\AppData\Local\Temp\71A.tmp"114⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\7A7.tmp"C:\Users\Admin\AppData\Local\Temp\7A7.tmp"115⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\834.tmp"C:\Users\Admin\AppData\Local\Temp\834.tmp"116⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\8B1.tmp"C:\Users\Admin\AppData\Local\Temp\8B1.tmp"117⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\92E.tmp"C:\Users\Admin\AppData\Local\Temp\92E.tmp"118⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\9BA.tmp"C:\Users\Admin\AppData\Local\Temp\9BA.tmp"119⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\A76.tmp"C:\Users\Admin\AppData\Local\Temp\A76.tmp"120⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\AF3.tmp"C:\Users\Admin\AppData\Local\Temp\AF3.tmp"121⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\B70.tmp"C:\Users\Admin\AppData\Local\Temp\B70.tmp"122⤵PID:5632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-