Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_6663f99420962e639fcbd0c07dba8499_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_6663f99420962e639fcbd0c07dba8499_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-07-05_6663f99420962e639fcbd0c07dba8499_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260705-ebezdahs8v
- SHA256 17ccc7d5e91080c0184daf8da2005d83f7765f4028f6855d8fd7cfd677d7b378
- MD5 6663f99420962e639fcbd0c07dba8499
- SHA1 48131de29c228ec424f204b08af2b2686c2ff5b0
- SHA512 49d042130416edb8b314503cf0b5903918b93426badc9475d84b582309fe3c6d2468a542423b87e5455a9cd1d68b0909ba376d8547d1febcd783d0245774d0fc
- SSDEEP 6144:qorf3lPvovsgZnqG2C7mOTeiL9DU/weTw3z0pX6njIXKAcuJ4B4MduMlW0TMEAhK:HU5rCOTeiJneTKoKn06QJBWW5ONZ
- TLSH T1C2B4F0217685C032E6C211700EE6EBA12D3A7D36AB2264C77B84777E6EB42D1E774347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5920 A1B9.tmp 5440 A256.tmp 1036 A2D3.tmp 5852 A35F.tmp 5824 A3CD.tmp 5376 A43A.tmp 6868 A4D6.tmp 1236 A553.tmp 3732 A5B1.tmp 2784 A61E.tmp 6896 A6AB.tmp 3236 A7B5.tmp 1496 A822.tmp 2640 A8AF.tmp 4740 A8FD.tmp 768 A97A.tmp 5868 A9E7.tmp 3984 AA45.tmp 3120 AAC2.tmp 4412 AB2F.tmp 4564 ABAC.tmp 2468 AC29.tmp 7164 AC87.tmp 2072 AD04.tmp 4400 AD71.tmp 3076 ADFE.tmp 3388 AE5C.tmp 1044 AED9.tmp 4080 AF46.tmp 4272 AFD3.tmp 4284 B030.tmp 2520 B0DC.tmp 3276 B13A.tmp 5448 B198.tmp 2884 B1F6.tmp 4860 B253.tmp 4992 B2C1.tmp 3260 B30F.tmp 6528 B36D.tmp 5888 B3DA.tmp 2228 B438.tmp 560 B486.tmp 3052 B4E4.tmp 5372 B570.tmp 4692 B5CE.tmp 6812 B62C.tmp 6900 B689.tmp 6284 B6E7.tmp 2508 B745.tmp 2600 B7A3.tmp 2060 B810.tmp 1368 B86E.tmp 6560 B8CC.tmp 3740 B929.tmp 5984 B987.tmp 1556 B9E5.tmp 6784 BA43.tmp 1112 BAA0.tmp 3044 BAFE.tmp 3680 BB5C.tmp 472 BBBA.tmp 2984 BC17.tmp 248 BC85.tmp 2792 BCF2.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 139E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 387B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B62C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B04B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 194B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 672C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A203.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AED9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C34B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5312 wrote to memory of 5920 5312 2026-07-05_6663f99420962e639fcbd0c07dba8499_elex_mafia_stealc_tofsee.exe 89 PID 5920 wrote to memory of 5440 5920 A1B9.tmp 90 PID 5440 wrote to memory of 1036 5440 A256.tmp 91 PID 1036 wrote to memory of 5852 1036 A2D3.tmp 92 PID 5852 wrote to memory of 5824 5852 A35F.tmp 93 PID 5824 wrote to memory of 5376 5824 A3CD.tmp 94 PID 5376 wrote to memory of 6868 5376 A43A.tmp 95 PID 6868 wrote to memory of 1236 6868 A4D6.tmp 96 PID 1236 wrote to memory of 3732 1236 A553.tmp 97 PID 3732 wrote to memory of 2784 3732 A5B1.tmp 98 PID 2784 wrote to memory of 6896 2784 A61E.tmp 99 PID 6896 wrote to memory of 3236 6896 A6AB.tmp 100 PID 3236 wrote to memory of 1496 3236 A7B5.tmp 101 PID 1496 wrote to memory of 2640 1496 A822.tmp 102 PID 2640 wrote to memory of 4740 2640 A8AF.tmp 103 PID 4740 wrote to memory of 768 4740 A8FD.tmp 104 PID 768 wrote to memory of 5868 768 A97A.tmp 105 PID 5868 wrote to memory of 3984 5868 A9E7.tmp 106 PID 3984 wrote to memory of 3120 3984 AA45.tmp 107 PID 3120 wrote to memory of 4412 3120 AAC2.tmp 108 PID 4412 wrote to memory of 4564 4412 AB2F.tmp 109 PID 4564 wrote to memory of 2468 4564 ABAC.tmp 110 PID 2468 wrote to memory of 7164 2468 AC29.tmp 111 PID 7164 wrote to memory of 2072 7164 AC87.tmp 112 PID 2072 wrote to memory of 4400 2072 AD04.tmp 113 PID 4400 wrote to memory of 3076 4400 AD71.tmp 114 PID 3076 wrote to memory of 3388 3076 ADFE.tmp 115 PID 3388 wrote to memory of 1044 3388 AE5C.tmp 116 PID 1044 wrote to memory of 4080 1044 AED9.tmp 117 PID 4080 wrote to memory of 4272 4080 AF46.tmp 118 PID 4272 wrote to memory of 4284 4272 AFD3.tmp 119 PID 4284 wrote to memory of 2520 4284 B030.tmp 120 PID 2520 wrote to memory of 3276 2520 B0DC.tmp 121 PID 3276 wrote to memory of 5448 3276 B13A.tmp 122 PID 5448 wrote to memory of 2884 5448 B198.tmp 123 PID 2884 wrote to memory of 4860 2884 B1F6.tmp 124 PID 4860 wrote to memory of 4992 4860 B253.tmp 125 PID 4992 wrote to memory of 3260 4992 B2C1.tmp 126 PID 3260 wrote to memory of 6528 3260 B30F.tmp 127 PID 6528 wrote to memory of 5888 6528 B36D.tmp 128 PID 5888 wrote to memory of 2228 5888 B3DA.tmp 129 PID 2228 wrote to memory of 560 2228 B438.tmp 130 PID 560 wrote to memory of 3052 560 B486.tmp 131 PID 3052 wrote to memory of 5372 3052 B4E4.tmp 132 PID 5372 wrote to memory of 4692 5372 B570.tmp 133 PID 4692 wrote to memory of 6812 4692 B5CE.tmp 134 PID 6812 wrote to memory of 6900 6812 B62C.tmp 135 PID 6900 wrote to memory of 6284 6900 B689.tmp 136 PID 6284 wrote to memory of 2508 6284 B6E7.tmp 137 PID 2508 wrote to memory of 2600 2508 B745.tmp 138 PID 2600 wrote to memory of 2060 2600 B7A3.tmp 139 PID 2060 wrote to memory of 1368 2060 B810.tmp 140 PID 1368 wrote to memory of 6560 1368 B86E.tmp 141 PID 6560 wrote to memory of 3740 6560 B8CC.tmp 142 PID 3740 wrote to memory of 5984 3740 B929.tmp 143 PID 5984 wrote to memory of 1556 5984 B987.tmp 144 PID 1556 wrote to memory of 6784 1556 B9E5.tmp 145 PID 6784 wrote to memory of 1112 6784 BA43.tmp 146 PID 1112 wrote to memory of 3044 1112 BAA0.tmp 147 PID 3044 wrote to memory of 3680 3044 BAFE.tmp 148 PID 3680 wrote to memory of 472 3680 BB5C.tmp 149 PID 472 wrote to memory of 2984 472 BBBA.tmp 150 PID 2984 wrote to memory of 248 2984 BC17.tmp 151 PID 248 wrote to memory of 2792 248 BC85.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_6663f99420962e639fcbd0c07dba8499_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_6663f99420962e639fcbd0c07dba8499_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\A256.tmp"C:\Users\Admin\AppData\Local\Temp\A256.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\A35F.tmp"C:\Users\Admin\AppData\Local\Temp\A35F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\A3CD.tmp"C:\Users\Admin\AppData\Local\Temp\A3CD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\A43A.tmp"C:\Users\Admin\AppData\Local\Temp\A43A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\A4D6.tmp"C:\Users\Admin\AppData\Local\Temp\A4D6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6868 -
C:\Users\Admin\AppData\Local\Temp\A553.tmp"C:\Users\Admin\AppData\Local\Temp\A553.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\A61E.tmp"C:\Users\Admin\AppData\Local\Temp\A61E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6896 -
C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\A822.tmp"C:\Users\Admin\AppData\Local\Temp\A822.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\A97A.tmp"C:\Users\Admin\AppData\Local\Temp\A97A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\AA45.tmp"C:\Users\Admin\AppData\Local\Temp\AA45.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\AC29.tmp"C:\Users\Admin\AppData\Local\Temp\AC29.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\AC87.tmp"C:\Users\Admin\AppData\Local\Temp\AC87.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7164 -
C:\Users\Admin\AppData\Local\Temp\AD04.tmp"C:\Users\Admin\AppData\Local\Temp\AD04.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\AD71.tmp"C:\Users\Admin\AppData\Local\Temp\AD71.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\AED9.tmp"C:\Users\Admin\AppData\Local\Temp\AED9.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\AF46.tmp"C:\Users\Admin\AppData\Local\Temp\AF46.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\AFD3.tmp"C:\Users\Admin\AppData\Local\Temp\AFD3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\B030.tmp"C:\Users\Admin\AppData\Local\Temp\B030.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\B13A.tmp"C:\Users\Admin\AppData\Local\Temp\B13A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\B198.tmp"C:\Users\Admin\AppData\Local\Temp\B198.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\B253.tmp"C:\Users\Admin\AppData\Local\Temp\B253.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\B2C1.tmp"C:\Users\Admin\AppData\Local\Temp\B2C1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\B30F.tmp"C:\Users\Admin\AppData\Local\Temp\B30F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\B36D.tmp"C:\Users\Admin\AppData\Local\Temp\B36D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6528 -
C:\Users\Admin\AppData\Local\Temp\B3DA.tmp"C:\Users\Admin\AppData\Local\Temp\B3DA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\B438.tmp"C:\Users\Admin\AppData\Local\Temp\B438.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\B486.tmp"C:\Users\Admin\AppData\Local\Temp\B486.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\B570.tmp"C:\Users\Admin\AppData\Local\Temp\B570.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\B62C.tmp"C:\Users\Admin\AppData\Local\Temp\B62C.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6812 -
C:\Users\Admin\AppData\Local\Temp\B689.tmp"C:\Users\Admin\AppData\Local\Temp\B689.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6900 -
C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6284 -
C:\Users\Admin\AppData\Local\Temp\B745.tmp"C:\Users\Admin\AppData\Local\Temp\B745.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\B810.tmp"C:\Users\Admin\AppData\Local\Temp\B810.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\B86E.tmp"C:\Users\Admin\AppData\Local\Temp\B86E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6560 -
C:\Users\Admin\AppData\Local\Temp\B929.tmp"C:\Users\Admin\AppData\Local\Temp\B929.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\B987.tmp"C:\Users\Admin\AppData\Local\Temp\B987.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\BA43.tmp"C:\Users\Admin\AppData\Local\Temp\BA43.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6784 -
C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\BBBA.tmp"C:\Users\Admin\AppData\Local\Temp\BBBA.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\BC17.tmp"C:\Users\Admin\AppData\Local\Temp\BC17.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\BC85.tmp"C:\Users\Admin\AppData\Local\Temp\BC85.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\BCF2.tmp"C:\Users\Admin\AppData\Local\Temp\BCF2.tmp"65⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\BD50.tmp"C:\Users\Admin\AppData\Local\Temp\BD50.tmp"66⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"67⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"68⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\BE69.tmp"C:\Users\Admin\AppData\Local\Temp\BE69.tmp"69⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"70⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\BF25.tmp"C:\Users\Admin\AppData\Local\Temp\BF25.tmp"71⤵PID:6636
-
C:\Users\Admin\AppData\Local\Temp\BF92.tmp"C:\Users\Admin\AppData\Local\Temp\BF92.tmp"72⤵PID:6648
-
C:\Users\Admin\AppData\Local\Temp\BFFF.tmp"C:\Users\Admin\AppData\Local\Temp\BFFF.tmp"73⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\C05D.tmp"C:\Users\Admin\AppData\Local\Temp\C05D.tmp"74⤵PID:6304
-
C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"75⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\C119.tmp"C:\Users\Admin\AppData\Local\Temp\C119.tmp"76⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\C176.tmp"C:\Users\Admin\AppData\Local\Temp\C176.tmp"77⤵PID:6292
-
C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"78⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\C232.tmp"C:\Users\Admin\AppData\Local\Temp\C232.tmp"79⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\C290.tmp"C:\Users\Admin\AppData\Local\Temp\C290.tmp"80⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"81⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\C34B.tmp"C:\Users\Admin\AppData\Local\Temp\C34B.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"83⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"84⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\C474.tmp"C:\Users\Admin\AppData\Local\Temp\C474.tmp"85⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\C4D2.tmp"C:\Users\Admin\AppData\Local\Temp\C4D2.tmp"86⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\C52F.tmp"C:\Users\Admin\AppData\Local\Temp\C52F.tmp"87⤵PID:7088
-
C:\Users\Admin\AppData\Local\Temp\C58D.tmp"C:\Users\Admin\AppData\Local\Temp\C58D.tmp"88⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"89⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\C649.tmp"C:\Users\Admin\AppData\Local\Temp\C649.tmp"90⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"91⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\C714.tmp"C:\Users\Admin\AppData\Local\Temp\C714.tmp"92⤵PID:6744
-
C:\Users\Admin\AppData\Local\Temp\C772.tmp"C:\Users\Admin\AppData\Local\Temp\C772.tmp"93⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\C7DF.tmp"C:\Users\Admin\AppData\Local\Temp\C7DF.tmp"94⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\C82D.tmp"C:\Users\Admin\AppData\Local\Temp\C82D.tmp"95⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\C89A.tmp"C:\Users\Admin\AppData\Local\Temp\C89A.tmp"96⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"97⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\C956.tmp"C:\Users\Admin\AppData\Local\Temp\C956.tmp"98⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"99⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\CA11.tmp"C:\Users\Admin\AppData\Local\Temp\CA11.tmp"100⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"101⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"102⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"103⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"104⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\CC05.tmp"C:\Users\Admin\AppData\Local\Temp\CC05.tmp"105⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"106⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"107⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"108⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\CD9C.tmp"C:\Users\Admin\AppData\Local\Temp\CD9C.tmp"109⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"110⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\CE48.tmp"C:\Users\Admin\AppData\Local\Temp\CE48.tmp"111⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"112⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\CF13.tmp"C:\Users\Admin\AppData\Local\Temp\CF13.tmp"113⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\CF70.tmp"C:\Users\Admin\AppData\Local\Temp\CF70.tmp"114⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"115⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\D03C.tmp"C:\Users\Admin\AppData\Local\Temp\D03C.tmp"116⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"117⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"118⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\D155.tmp"C:\Users\Admin\AppData\Local\Temp\D155.tmp"119⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"120⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\D210.tmp"C:\Users\Admin\AppData\Local\Temp\D210.tmp"121⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\D26E.tmp"C:\Users\Admin\AppData\Local\Temp\D26E.tmp"122⤵PID:6296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-