Analysis
- max time kernel
123s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-28_cce3f695f00a3133cd5ac33e9582b2d0_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_cce3f695f00a3133cd5ac33e9582b2d0_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260618-en
3 signatures
150 seconds
General
- Target 2026-06-28_cce3f695f00a3133cd5ac33e9582b2d0_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260628-xplcesb12v
- SHA256 df855d32f18ec0b077c8de13c142deb19a3a0d72583de21315663cc78a3e8026
- MD5 cce3f695f00a3133cd5ac33e9582b2d0
- SHA1 1aaaa0cfa47e273d879153b879eeda671943b858
- SHA512 367db5c6d4e1e521062ad8ca115ae6bf89b6f08ec16823e38d569f2652eaf55547aef69b7347f9239e6c71216c9dc1d132615f03ed49ad927990a9362178c4a8
- SSDEEP 12288:NU5rCOTeijPryCQfOcTrz4P3eLbTZwlH:NUQOJj5/crz4mfTSlH
- TLSH T16BB4F1267585C033E6C202710AE6EBA26A3ABD35573524C33794633E6FB66E0E775303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1784 CB8.tmp 5484 D93.tmp 3756 E1F.tmp 5812 EBC.tmp 4144 FB6.tmp 3712 10A0.tmp 3824 113C.tmp 3768 11F8.tmp 4868 1301.tmp 2720 13FB.tmp 2484 1469.tmp 1516 14E6.tmp 5744 15A1.tmp 1156 163D.tmp 2816 16DA.tmp 2756 17A5.tmp 5884 1860.tmp 916 18FD.tmp 1876 19B8.tmp 2492 1A45.tmp 2608 1B3F.tmp 1336 1C0A.tmp 6040 1CC5.tmp 5824 1D71.tmp 4184 1E0D.tmp 4648 1EC9.tmp 248 1F65.tmp 3744 2021.tmp 3260 20CD.tmp 4432 2178.tmp 4496 2244.tmp 2956 230F.tmp 4216 23DA.tmp 1104 2457.tmp 1720 24E3.tmp 2496 2570.tmp 3324 260C.tmp 832 2699.tmp 4164 2745.tmp 3008 27D1.tmp 4700 284E.tmp 3056 28CB.tmp 2824 2958.tmp 5100 29E5.tmp 4676 2A71.tmp 3516 2B1D.tmp 2360 2B8B.tmp 952 2C08.tmp 5988 2C94.tmp 1276 2D30.tmp 1256 2D9E.tmp 5416 2E2A.tmp 5844 2EC7.tmp 5536 2F73.tmp 5460 2FF0.tmp 6092 306D.tmp 2068 30F9.tmp 5168 3167.tmp 4072 31E4.tmp 5716 3280.tmp 1524 330C.tmp 1092 337A.tmp 2052 33E7.tmp 2244 3464.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 706E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E65A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E611.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 184C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C082.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ED0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A83C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B24F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2462.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D86F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C72E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D97E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 808B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E69D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 306D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 859C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 615B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8449.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3716 wrote to memory of 1784 3716 2026-06-28_cce3f695f00a3133cd5ac33e9582b2d0_elex_mafia_stealc_tofsee.exe 89 PID 1784 wrote to memory of 5484 1784 CB8.tmp 90 PID 5484 wrote to memory of 3756 5484 D93.tmp 91 PID 3756 wrote to memory of 5812 3756 E1F.tmp 92 PID 5812 wrote to memory of 4144 5812 EBC.tmp 93 PID 4144 wrote to memory of 3712 4144 FB6.tmp 94 PID 3712 wrote to memory of 3824 3712 10A0.tmp 95 PID 3824 wrote to memory of 3768 3824 113C.tmp 96 PID 3768 wrote to memory of 4868 3768 11F8.tmp 97 PID 4868 wrote to memory of 2720 4868 1301.tmp 98 PID 2720 wrote to memory of 2484 2720 13FB.tmp 99 PID 2484 wrote to memory of 1516 2484 1469.tmp 100 PID 1516 wrote to memory of 5744 1516 14E6.tmp 101 PID 5744 wrote to memory of 1156 5744 15A1.tmp 102 PID 1156 wrote to memory of 2816 1156 163D.tmp 103 PID 2816 wrote to memory of 2756 2816 16DA.tmp 104 PID 2756 wrote to memory of 5884 2756 17A5.tmp 105 PID 5884 wrote to memory of 916 5884 1860.tmp 106 PID 916 wrote to memory of 1876 916 18FD.tmp 107 PID 1876 wrote to memory of 2492 1876 19B8.tmp 108 PID 2492 wrote to memory of 2608 2492 1A45.tmp 109 PID 2608 wrote to memory of 1336 2608 1B3F.tmp 110 PID 1336 wrote to memory of 6040 1336 1C0A.tmp 111 PID 6040 wrote to memory of 5824 6040 1CC5.tmp 112 PID 5824 wrote to memory of 4184 5824 1D71.tmp 113 PID 4184 wrote to memory of 4648 4184 1E0D.tmp 114 PID 4648 wrote to memory of 248 4648 1EC9.tmp 115 PID 248 wrote to memory of 3744 248 1F65.tmp 116 PID 3744 wrote to memory of 3260 3744 2021.tmp 117 PID 3260 wrote to memory of 4432 3260 20CD.tmp 118 PID 4432 wrote to memory of 4496 4432 2178.tmp 119 PID 4496 wrote to memory of 2956 4496 2244.tmp 120 PID 2956 wrote to memory of 4216 2956 230F.tmp 121 PID 4216 wrote to memory of 1104 4216 23DA.tmp 122 PID 1104 wrote to memory of 1720 1104 2457.tmp 123 PID 1720 wrote to memory of 2496 1720 24E3.tmp 124 PID 2496 wrote to memory of 3324 2496 2570.tmp 125 PID 3324 wrote to memory of 832 3324 260C.tmp 126 PID 832 wrote to memory of 4164 832 2699.tmp 127 PID 4164 wrote to memory of 3008 4164 2745.tmp 128 PID 3008 wrote to memory of 4700 3008 27D1.tmp 129 PID 4700 wrote to memory of 3056 4700 284E.tmp 130 PID 3056 wrote to memory of 2824 3056 28CB.tmp 131 PID 2824 wrote to memory of 5100 2824 2958.tmp 132 PID 5100 wrote to memory of 4676 5100 29E5.tmp 133 PID 4676 wrote to memory of 3516 4676 2A71.tmp 134 PID 3516 wrote to memory of 2360 3516 2B1D.tmp 135 PID 2360 wrote to memory of 952 2360 2B8B.tmp 136 PID 952 wrote to memory of 5988 952 2C08.tmp 137 PID 5988 wrote to memory of 1276 5988 2C94.tmp 138 PID 1276 wrote to memory of 1256 1276 2D30.tmp 139 PID 1256 wrote to memory of 5416 1256 2D9E.tmp 140 PID 5416 wrote to memory of 5844 5416 2E2A.tmp 141 PID 5844 wrote to memory of 5536 5844 2EC7.tmp 142 PID 5536 wrote to memory of 5460 5536 2F73.tmp 143 PID 5460 wrote to memory of 6092 5460 2FF0.tmp 144 PID 6092 wrote to memory of 2068 6092 306D.tmp 145 PID 2068 wrote to memory of 5168 2068 30F9.tmp 146 PID 5168 wrote to memory of 4072 5168 3167.tmp 147 PID 4072 wrote to memory of 5716 4072 31E4.tmp 148 PID 5716 wrote to memory of 1524 5716 3280.tmp 149 PID 1524 wrote to memory of 1092 1524 330C.tmp 150 PID 1092 wrote to memory of 2052 1092 337A.tmp 151 PID 2052 wrote to memory of 2244 2052 33E7.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_cce3f695f00a3133cd5ac33e9582b2d0_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_cce3f695f00a3133cd5ac33e9582b2d0_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\CB8.tmp"C:\Users\Admin\AppData\Local\Temp\CB8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\D93.tmp"C:\Users\Admin\AppData\Local\Temp\D93.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\E1F.tmp"C:\Users\Admin\AppData\Local\Temp\E1F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\EBC.tmp"C:\Users\Admin\AppData\Local\Temp\EBC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\FB6.tmp"C:\Users\Admin\AppData\Local\Temp\FB6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\10A0.tmp"C:\Users\Admin\AppData\Local\Temp\10A0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\113C.tmp"C:\Users\Admin\AppData\Local\Temp\113C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\11F8.tmp"C:\Users\Admin\AppData\Local\Temp\11F8.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\1301.tmp"C:\Users\Admin\AppData\Local\Temp\1301.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\13FB.tmp"C:\Users\Admin\AppData\Local\Temp\13FB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\1469.tmp"C:\Users\Admin\AppData\Local\Temp\1469.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\14E6.tmp"C:\Users\Admin\AppData\Local\Temp\14E6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\163D.tmp"C:\Users\Admin\AppData\Local\Temp\163D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\16DA.tmp"C:\Users\Admin\AppData\Local\Temp\16DA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\17A5.tmp"C:\Users\Admin\AppData\Local\Temp\17A5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\1860.tmp"C:\Users\Admin\AppData\Local\Temp\1860.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\1CC5.tmp"C:\Users\Admin\AppData\Local\Temp\1CC5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\1D71.tmp"C:\Users\Admin\AppData\Local\Temp\1D71.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\1F65.tmp"C:\Users\Admin\AppData\Local\Temp\1F65.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\2178.tmp"C:\Users\Admin\AppData\Local\Temp\2178.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\2244.tmp"C:\Users\Admin\AppData\Local\Temp\2244.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\230F.tmp"C:\Users\Admin\AppData\Local\Temp\230F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\23DA.tmp"C:\Users\Admin\AppData\Local\Temp\23DA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\2457.tmp"C:\Users\Admin\AppData\Local\Temp\2457.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\24E3.tmp"C:\Users\Admin\AppData\Local\Temp\24E3.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\2570.tmp"C:\Users\Admin\AppData\Local\Temp\2570.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\260C.tmp"C:\Users\Admin\AppData\Local\Temp\260C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\2699.tmp"C:\Users\Admin\AppData\Local\Temp\2699.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\2745.tmp"C:\Users\Admin\AppData\Local\Temp\2745.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\27D1.tmp"C:\Users\Admin\AppData\Local\Temp\27D1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\284E.tmp"C:\Users\Admin\AppData\Local\Temp\284E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\28CB.tmp"C:\Users\Admin\AppData\Local\Temp\28CB.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\2958.tmp"C:\Users\Admin\AppData\Local\Temp\2958.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\29E5.tmp"C:\Users\Admin\AppData\Local\Temp\29E5.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\2A71.tmp"C:\Users\Admin\AppData\Local\Temp\2A71.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\2C94.tmp"C:\Users\Admin\AppData\Local\Temp\2C94.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\2D30.tmp"C:\Users\Admin\AppData\Local\Temp\2D30.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\2F73.tmp"C:\Users\Admin\AppData\Local\Temp\2F73.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\306D.tmp"C:\Users\Admin\AppData\Local\Temp\306D.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\30F9.tmp"C:\Users\Admin\AppData\Local\Temp\30F9.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3167.tmp"C:\Users\Admin\AppData\Local\Temp\3167.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\31E4.tmp"C:\Users\Admin\AppData\Local\Temp\31E4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\3280.tmp"C:\Users\Admin\AppData\Local\Temp\3280.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\330C.tmp"C:\Users\Admin\AppData\Local\Temp\330C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\337A.tmp"C:\Users\Admin\AppData\Local\Temp\337A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\33E7.tmp"C:\Users\Admin\AppData\Local\Temp\33E7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3464.tmp"C:\Users\Admin\AppData\Local\Temp\3464.tmp"65⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\34D2.tmp"C:\Users\Admin\AppData\Local\Temp\34D2.tmp"66⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\353F.tmp"C:\Users\Admin\AppData\Local\Temp\353F.tmp"67⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\35AC.tmp"C:\Users\Admin\AppData\Local\Temp\35AC.tmp"68⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\3658.tmp"C:\Users\Admin\AppData\Local\Temp\3658.tmp"69⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\36D5.tmp"C:\Users\Admin\AppData\Local\Temp\36D5.tmp"70⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\3762.tmp"C:\Users\Admin\AppData\Local\Temp\3762.tmp"71⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\37DF.tmp"C:\Users\Admin\AppData\Local\Temp\37DF.tmp"72⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\388B.tmp"C:\Users\Admin\AppData\Local\Temp\388B.tmp"73⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\3927.tmp"C:\Users\Admin\AppData\Local\Temp\3927.tmp"74⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\39F2.tmp"C:\Users\Admin\AppData\Local\Temp\39F2.tmp"75⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"76⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"77⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\3BD6.tmp"C:\Users\Admin\AppData\Local\Temp\3BD6.tmp"78⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\3C53.tmp"C:\Users\Admin\AppData\Local\Temp\3C53.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"80⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"81⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"82⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\3E76.tmp"C:\Users\Admin\AppData\Local\Temp\3E76.tmp"83⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"84⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"85⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\400D.tmp"C:\Users\Admin\AppData\Local\Temp\400D.tmp"86⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"87⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"88⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\41E1.tmp"C:\Users\Admin\AppData\Local\Temp\41E1.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\426E.tmp"C:\Users\Admin\AppData\Local\Temp\426E.tmp"90⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\42DB.tmp"C:\Users\Admin\AppData\Local\Temp\42DB.tmp"91⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\4349.tmp"C:\Users\Admin\AppData\Local\Temp\4349.tmp"92⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\43D5.tmp"C:\Users\Admin\AppData\Local\Temp\43D5.tmp"93⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\44FE.tmp"C:\Users\Admin\AppData\Local\Temp\44FE.tmp"95⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\457B.tmp"C:\Users\Admin\AppData\Local\Temp\457B.tmp"96⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\4617.tmp"C:\Users\Admin\AppData\Local\Temp\4617.tmp"97⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\46A4.tmp"C:\Users\Admin\AppData\Local\Temp\46A4.tmp"98⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\4721.tmp"C:\Users\Admin\AppData\Local\Temp\4721.tmp"99⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\47AE.tmp"C:\Users\Admin\AppData\Local\Temp\47AE.tmp"100⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\483A.tmp"C:\Users\Admin\AppData\Local\Temp\483A.tmp"101⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\48E6.tmp"C:\Users\Admin\AppData\Local\Temp\48E6.tmp"102⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\4973.tmp"C:\Users\Admin\AppData\Local\Temp\4973.tmp"103⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\4A1F.tmp"C:\Users\Admin\AppData\Local\Temp\4A1F.tmp"104⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"105⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\4B28.tmp"C:\Users\Admin\AppData\Local\Temp\4B28.tmp"106⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\4B96.tmp"C:\Users\Admin\AppData\Local\Temp\4B96.tmp"107⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\4C13.tmp"C:\Users\Admin\AppData\Local\Temp\4C13.tmp"108⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"109⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"110⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\4E55.tmp"C:\Users\Admin\AppData\Local\Temp\4E55.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"113⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"114⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"115⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\5049.tmp"C:\Users\Admin\AppData\Local\Temp\5049.tmp"116⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\50F5.tmp"C:\Users\Admin\AppData\Local\Temp\50F5.tmp"117⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\5181.tmp"C:\Users\Admin\AppData\Local\Temp\5181.tmp"118⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\520E.tmp"C:\Users\Admin\AppData\Local\Temp\520E.tmp"119⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\529B.tmp"C:\Users\Admin\AppData\Local\Temp\529B.tmp"120⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\5327.tmp"C:\Users\Admin\AppData\Local\Temp\5327.tmp"121⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\5395.tmp"C:\Users\Admin\AppData\Local\Temp\5395.tmp"122⤵PID:1752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-