Analysis
- max time kernel
136s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 20:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-25_c0db33ff8a9b4c3237511e9402ccf578_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_c0db33ff8a9b4c3237511e9402ccf578_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-06-25_c0db33ff8a9b4c3237511e9402ccf578_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260629-yr8feaes7v
- SHA256 40d7deae6d9adc965185f3cb69f26552145e078709e7abfcb1c0d6f1333e9ee6
- MD5 c0db33ff8a9b4c3237511e9402ccf578
- SHA1 6e8a79b1d24cb8ac0325ec0f069d6c42e9b11ef1
- SHA512 ff428e5c383f28927801c793860bcd3ccc9880bdb1f64f849700ef1d147453815bd07295810fbcea89a177117353bd450e6dc383b68670245f2a64529ddd1be6
- SSDEEP 12288:wU5rCOTeiDqexYTHeNkH7LT4OKW2Gz0RjNZ+3/v+I9hUG2VA:wUQOJD8YkPKGsjNGEA
- TLSH T135E4D02173D88532E9FB037859B5F6655D7EBD226722D6CF2F8012AE09B1BC08631763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1800 C704.tmp 3108 C7B0.tmp 4816 C8D9.tmp 5736 C9C3.tmp 5896 CA9E.tmp 2728 CB5A.tmp 4680 CBE6.tmp 2844 CD2E.tmp 6060 CE86.tmp 4456 CF70.tmp 5600 CFED.tmp 5752 D136.tmp 3308 D210.tmp 4636 D2FB.tmp 1932 D452.tmp 4200 D59B.tmp 5848 D675.tmp 3580 D76F.tmp 5472 D889.tmp 5408 D992.tmp 5572 DAAB.tmp 1524 DBD4.tmp 1728 DD0D.tmp 2880 DE26.tmp 6140 DF30.tmp 244 E049.tmp 2648 E162.tmp 1856 E23D.tmp 4528 E318.tmp 4508 E3F2.tmp 2872 E54A.tmp 2428 E683.tmp 3396 E7DA.tmp 5312 E8B5.tmp 5244 E971.tmp 5468 EA2C.tmp 3136 EAA9.tmp 2792 EB94.tmp 1928 EC4F.tmp 844 ED1A.tmp 1044 EDD6.tmp 4116 EEA1.tmp 2392 EF2D.tmp 2268 F008.tmp 5116 F0B4.tmp 4900 F160.tmp 5700 F1FC.tmp 2580 F279.tmp 4460 F315.tmp 1240 F392.tmp 1660 F41F.tmp 3816 F49C.tmp 700 F509.tmp 3932 F596.tmp 4180 F623.tmp 1996 F6AF.tmp 4496 F73C.tmp 2176 F7B9.tmp 6044 F874.tmp 832 F8E2.tmp 5740 F95F.tmp 5216 F9DC.tmp 5676 FA59.tmp 2092 FAD6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 332C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4864.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B111.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 305D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A49E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C704.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 884C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ACC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 546.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E620.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70D1.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1800 1500 2026-06-25_c0db33ff8a9b4c3237511e9402ccf578_elex_mafia_stealc_tofsee.exe 87 PID 1800 wrote to memory of 3108 1800 C704.tmp 88 PID 3108 wrote to memory of 4816 3108 C7B0.tmp 89 PID 4816 wrote to memory of 5736 4816 C8D9.tmp 90 PID 5736 wrote to memory of 5896 5736 C9C3.tmp 91 PID 5896 wrote to memory of 2728 5896 CA9E.tmp 92 PID 2728 wrote to memory of 4680 2728 CB5A.tmp 93 PID 4680 wrote to memory of 2844 4680 CBE6.tmp 94 PID 2844 wrote to memory of 6060 2844 CD2E.tmp 95 PID 6060 wrote to memory of 4456 6060 CE86.tmp 96 PID 4456 wrote to memory of 5600 4456 CF70.tmp 97 PID 5600 wrote to memory of 5752 5600 CFED.tmp 98 PID 5752 wrote to memory of 3308 5752 D136.tmp 99 PID 3308 wrote to memory of 4636 3308 D210.tmp 100 PID 4636 wrote to memory of 1932 4636 D2FB.tmp 101 PID 1932 wrote to memory of 4200 1932 D452.tmp 102 PID 4200 wrote to memory of 5848 4200 D59B.tmp 103 PID 5848 wrote to memory of 3580 5848 D675.tmp 104 PID 3580 wrote to memory of 5472 3580 D76F.tmp 105 PID 5472 wrote to memory of 5408 5472 D889.tmp 106 PID 5408 wrote to memory of 5572 5408 D992.tmp 107 PID 5572 wrote to memory of 1524 5572 DAAB.tmp 108 PID 1524 wrote to memory of 1728 1524 DBD4.tmp 109 PID 1728 wrote to memory of 2880 1728 DD0D.tmp 110 PID 2880 wrote to memory of 6140 2880 DE26.tmp 111 PID 6140 wrote to memory of 244 6140 DF30.tmp 112 PID 244 wrote to memory of 2648 244 E049.tmp 113 PID 2648 wrote to memory of 1856 2648 E162.tmp 114 PID 1856 wrote to memory of 4528 1856 E23D.tmp 115 PID 4528 wrote to memory of 4508 4528 E318.tmp 116 PID 4508 wrote to memory of 2872 4508 E3F2.tmp 117 PID 2872 wrote to memory of 2428 2872 E54A.tmp 118 PID 2428 wrote to memory of 3396 2428 E683.tmp 119 PID 3396 wrote to memory of 5312 3396 E7DA.tmp 120 PID 5312 wrote to memory of 5244 5312 E8B5.tmp 121 PID 5244 wrote to memory of 5468 5244 E971.tmp 122 PID 5468 wrote to memory of 3136 5468 EA2C.tmp 123 PID 3136 wrote to memory of 2792 3136 EAA9.tmp 124 PID 2792 wrote to memory of 1928 2792 EB94.tmp 125 PID 1928 wrote to memory of 844 1928 EC4F.tmp 126 PID 844 wrote to memory of 1044 844 ED1A.tmp 127 PID 1044 wrote to memory of 4116 1044 EDD6.tmp 128 PID 4116 wrote to memory of 2392 4116 EEA1.tmp 129 PID 2392 wrote to memory of 2268 2392 EF2D.tmp 130 PID 2268 wrote to memory of 5116 2268 F008.tmp 131 PID 5116 wrote to memory of 4900 5116 F0B4.tmp 132 PID 4900 wrote to memory of 5700 4900 F160.tmp 133 PID 5700 wrote to memory of 2580 5700 F1FC.tmp 134 PID 2580 wrote to memory of 4460 2580 F279.tmp 135 PID 4460 wrote to memory of 1240 4460 F315.tmp 136 PID 1240 wrote to memory of 1660 1240 F392.tmp 137 PID 1660 wrote to memory of 3816 1660 F41F.tmp 138 PID 3816 wrote to memory of 700 3816 F49C.tmp 139 PID 700 wrote to memory of 3932 700 F509.tmp 140 PID 3932 wrote to memory of 4180 3932 F596.tmp 141 PID 4180 wrote to memory of 1996 4180 F623.tmp 142 PID 1996 wrote to memory of 4496 1996 F6AF.tmp 143 PID 4496 wrote to memory of 2176 4496 F73C.tmp 144 PID 2176 wrote to memory of 6044 2176 F7B9.tmp 145 PID 6044 wrote to memory of 832 6044 F874.tmp 146 PID 832 wrote to memory of 5740 832 F8E2.tmp 147 PID 5740 wrote to memory of 5216 5740 F95F.tmp 148 PID 5216 wrote to memory of 5676 5216 F9DC.tmp 149 PID 5676 wrote to memory of 2092 5676 FA59.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_c0db33ff8a9b4c3237511e9402ccf578_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_c0db33ff8a9b4c3237511e9402ccf578_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\C704.tmp"C:\Users\Admin\AppData\Local\Temp\C704.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\CE86.tmp"C:\Users\Admin\AppData\Local\Temp\CE86.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\CF70.tmp"C:\Users\Admin\AppData\Local\Temp\CF70.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\CFED.tmp"C:\Users\Admin\AppData\Local\Temp\CFED.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\D136.tmp"C:\Users\Admin\AppData\Local\Temp\D136.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\D210.tmp"C:\Users\Admin\AppData\Local\Temp\D210.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\D452.tmp"C:\Users\Admin\AppData\Local\Temp\D452.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\D675.tmp"C:\Users\Admin\AppData\Local\Temp\D675.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\D992.tmp"C:\Users\Admin\AppData\Local\Temp\D992.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\DBD4.tmp"C:\Users\Admin\AppData\Local\Temp\DBD4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\DE26.tmp"C:\Users\Admin\AppData\Local\Temp\DE26.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\DF30.tmp"C:\Users\Admin\AppData\Local\Temp\DF30.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\E049.tmp"C:\Users\Admin\AppData\Local\Temp\E049.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\E162.tmp"C:\Users\Admin\AppData\Local\Temp\E162.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\E23D.tmp"C:\Users\Admin\AppData\Local\Temp\E23D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\E318.tmp"C:\Users\Admin\AppData\Local\Temp\E318.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\E3F2.tmp"C:\Users\Admin\AppData\Local\Temp\E3F2.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\E54A.tmp"C:\Users\Admin\AppData\Local\Temp\E54A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\E683.tmp"C:\Users\Admin\AppData\Local\Temp\E683.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\E971.tmp"C:\Users\Admin\AppData\Local\Temp\E971.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\EB94.tmp"C:\Users\Admin\AppData\Local\Temp\EB94.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\EEA1.tmp"C:\Users\Admin\AppData\Local\Temp\EEA1.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\EF2D.tmp"C:\Users\Admin\AppData\Local\Temp\EF2D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\F008.tmp"C:\Users\Admin\AppData\Local\Temp\F008.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\F0B4.tmp"C:\Users\Admin\AppData\Local\Temp\F0B4.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\F160.tmp"C:\Users\Admin\AppData\Local\Temp\F160.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\F279.tmp"C:\Users\Admin\AppData\Local\Temp\F279.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\F315.tmp"C:\Users\Admin\AppData\Local\Temp\F315.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\F392.tmp"C:\Users\Admin\AppData\Local\Temp\F392.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\F509.tmp"C:\Users\Admin\AppData\Local\Temp\F509.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\F596.tmp"C:\Users\Admin\AppData\Local\Temp\F596.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\F623.tmp"C:\Users\Admin\AppData\Local\Temp\F623.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\F6AF.tmp"C:\Users\Admin\AppData\Local\Temp\F6AF.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\F73C.tmp"C:\Users\Admin\AppData\Local\Temp\F73C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\F874.tmp"C:\Users\Admin\AppData\Local\Temp\F874.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\F95F.tmp"C:\Users\Admin\AppData\Local\Temp\F95F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\F9DC.tmp"C:\Users\Admin\AppData\Local\Temp\F9DC.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\FA59.tmp"C:\Users\Admin\AppData\Local\Temp\FA59.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\FAD6.tmp"C:\Users\Admin\AppData\Local\Temp\FAD6.tmp"65⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\FB62.tmp"C:\Users\Admin\AppData\Local\Temp\FB62.tmp"66⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"67⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"68⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\FCF9.tmp"C:\Users\Admin\AppData\Local\Temp\FCF9.tmp"69⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\FD76.tmp"C:\Users\Admin\AppData\Local\Temp\FD76.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\FE12.tmp"C:\Users\Admin\AppData\Local\Temp\FE12.tmp"71⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\FE8F.tmp"C:\Users\Admin\AppData\Local\Temp\FE8F.tmp"72⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"73⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\FFD7.tmp"C:\Users\Admin\AppData\Local\Temp\FFD7.tmp"74⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\64.tmp"C:\Users\Admin\AppData\Local\Temp\64.tmp"75⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\D1.tmp"C:\Users\Admin\AppData\Local\Temp\D1.tmp"76⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\15E.tmp"C:\Users\Admin\AppData\Local\Temp\15E.tmp"77⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\1CB.tmp"C:\Users\Admin\AppData\Local\Temp\1CB.tmp"78⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\258.tmp"C:\Users\Admin\AppData\Local\Temp\258.tmp"79⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\2C5.tmp"C:\Users\Admin\AppData\Local\Temp\2C5.tmp"80⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\361.tmp"C:\Users\Admin\AppData\Local\Temp\361.tmp"81⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\41D.tmp"C:\Users\Admin\AppData\Local\Temp\41D.tmp"82⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\4A9.tmp"C:\Users\Admin\AppData\Local\Temp\4A9.tmp"83⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\546.tmp"C:\Users\Admin\AppData\Local\Temp\546.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\5E2.tmp"C:\Users\Admin\AppData\Local\Temp\5E2.tmp"85⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\749.tmp"C:\Users\Admin\AppData\Local\Temp\749.tmp"87⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\7C6.tmp"C:\Users\Admin\AppData\Local\Temp\7C6.tmp"88⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\853.tmp"C:\Users\Admin\AppData\Local\Temp\853.tmp"89⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\8D0.tmp"C:\Users\Admin\AppData\Local\Temp\8D0.tmp"90⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\96C.tmp"C:\Users\Admin\AppData\Local\Temp\96C.tmp"91⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\9F9.tmp"C:\Users\Admin\AppData\Local\Temp\9F9.tmp"92⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\A85.tmp"C:\Users\Admin\AppData\Local\Temp\A85.tmp"93⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\B22.tmp"C:\Users\Admin\AppData\Local\Temp\B22.tmp"94⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\BAE.tmp"C:\Users\Admin\AppData\Local\Temp\BAE.tmp"95⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\C3B.tmp"C:\Users\Admin\AppData\Local\Temp\C3B.tmp"96⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\CA8.tmp"C:\Users\Admin\AppData\Local\Temp\CA8.tmp"97⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\D25.tmp"C:\Users\Admin\AppData\Local\Temp\D25.tmp"98⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\DA2.tmp"C:\Users\Admin\AppData\Local\Temp\DA2.tmp"99⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\E10.tmp"C:\Users\Admin\AppData\Local\Temp\E10.tmp"100⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\E9C.tmp"C:\Users\Admin\AppData\Local\Temp\E9C.tmp"101⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"102⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\FA6.tmp"C:\Users\Admin\AppData\Local\Temp\FA6.tmp"103⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\1033.tmp"C:\Users\Admin\AppData\Local\Temp\1033.tmp"104⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\10BF.tmp"C:\Users\Admin\AppData\Local\Temp\10BF.tmp"105⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\114C.tmp"C:\Users\Admin\AppData\Local\Temp\114C.tmp"106⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\11C9.tmp"C:\Users\Admin\AppData\Local\Temp\11C9.tmp"107⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\1265.tmp"C:\Users\Admin\AppData\Local\Temp\1265.tmp"108⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\12F2.tmp"C:\Users\Admin\AppData\Local\Temp\12F2.tmp"109⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\139E.tmp"C:\Users\Admin\AppData\Local\Temp\139E.tmp"110⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\141B.tmp"C:\Users\Admin\AppData\Local\Temp\141B.tmp"111⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\1498.tmp"C:\Users\Admin\AppData\Local\Temp\1498.tmp"112⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\1505.tmp"C:\Users\Admin\AppData\Local\Temp\1505.tmp"113⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\1572.tmp"C:\Users\Admin\AppData\Local\Temp\1572.tmp"114⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\15EF.tmp"C:\Users\Admin\AppData\Local\Temp\15EF.tmp"115⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\165D.tmp"C:\Users\Admin\AppData\Local\Temp\165D.tmp"116⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\16E9.tmp"C:\Users\Admin\AppData\Local\Temp\16E9.tmp"117⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\1766.tmp"C:\Users\Admin\AppData\Local\Temp\1766.tmp"118⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\17F3.tmp"C:\Users\Admin\AppData\Local\Temp\17F3.tmp"119⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\188F.tmp"C:\Users\Admin\AppData\Local\Temp\188F.tmp"120⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"121⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"122⤵PID:1120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-