Analysis
- max time kernel
131s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_1dcf55c6eb192ba01e31bd558b0e6a11_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_1dcf55c6eb192ba01e31bd558b0e6a11_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260706-en
3 signatures
150 seconds
General
- Target 2026-07-06_1dcf55c6eb192ba01e31bd558b0e6a11_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260706-2c8dmscx61
- SHA256 d1f45e049a6e399b0fe4166ddf363f7e4b7cbfac813d59a6cafce6b1754236b3
- MD5 1dcf55c6eb192ba01e31bd558b0e6a11
- SHA1 a2cedf294dbed4c8c340d3bfde7d255c2158f991
- SHA512 64892edc554e545d96c0f3f4d58392f3ad3f7a9e710ff38bd6a43a564895454816382beb5bcb0b2aa3318fb870d598ea8ab0e1b6bd1cbfa21a357df207c9a103
- SSDEEP 12288:9U5rCOTei6YPwPq9c0aiZGu0S1+QzJXl+Tk3RqZoXWjdqpby1grA70G+o:9UQOJ6YdjNEn1QzJXIMqqGh4yATXo
- TLSH T106E401217984C532E9D212314EE6EBB1697EBC755726A4C73BC4672E2FB02E1D239307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2428 FC5.tmp 2232 1081.tmp 2820 117B.tmp 4168 1294.tmp 3276 135F.tmp 1816 1488.tmp 3468 1505.tmp 2636 160F.tmp 2768 16F9.tmp 5748 1786.tmp 5696 1870.tmp 3476 191C.tmp 2312 19C8.tmp 3684 1A74.tmp 5152 1B00.tmp 3232 1BCB.tmp 1872 1CA6.tmp 724 1D13.tmp 5684 1DBF.tmp 2656 1E8A.tmp 2644 1F36.tmp 4120 1FE2.tmp 5916 20BD.tmp 5340 2198.tmp 3408 2253.tmp 5664 230F.tmp 3436 2409.tmp 240 24C4.tmp 300 2580.tmp 5464 267A.tmp 1700 2745.tmp 1576 2820.tmp 5304 28DB.tmp 1392 2948.tmp 5472 29C5.tmp 1588 2A62.tmp 3812 2ADF.tmp 4464 2B7B.tmp 2416 2C08.tmp 2060 2C94.tmp 4576 2D21.tmp 4492 2DAD.tmp 1320 2E2A.tmp 2084 2EA7.tmp 2068 2F34.tmp 5388 2FA1.tmp 3112 301E.tmp 1100 309B.tmp 5208 3118.tmp 3340 31B5.tmp 1632 3241.tmp 3604 32BE.tmp 5088 337A.tmp 936 3416.tmp 916 34A3.tmp 5740 354F.tmp 5312 35CC.tmp 4324 3649.tmp 6016 36E5.tmp 1368 3791.tmp 5640 382D.tmp 2192 38C9.tmp 5996 3946.tmp 3712 39D3.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8667.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 835F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 301E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 857D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D88F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B220.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 351B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E97C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C18C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 594D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F638.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 421B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7262.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8955.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E90E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53DE.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6080 wrote to memory of 2428 6080 2026-07-06_1dcf55c6eb192ba01e31bd558b0e6a11_elex_mafia_stealc_tofsee.exe 87 PID 2428 wrote to memory of 2232 2428 FC5.tmp 88 PID 2232 wrote to memory of 2820 2232 1081.tmp 89 PID 2820 wrote to memory of 4168 2820 117B.tmp 90 PID 4168 wrote to memory of 3276 4168 1294.tmp 91 PID 3276 wrote to memory of 1816 3276 135F.tmp 92 PID 1816 wrote to memory of 3468 1816 1488.tmp 93 PID 3468 wrote to memory of 2636 3468 1505.tmp 94 PID 2636 wrote to memory of 2768 2636 160F.tmp 95 PID 2768 wrote to memory of 5748 2768 16F9.tmp 96 PID 5748 wrote to memory of 5696 5748 1786.tmp 97 PID 5696 wrote to memory of 3476 5696 1870.tmp 98 PID 3476 wrote to memory of 2312 3476 191C.tmp 99 PID 2312 wrote to memory of 3684 2312 19C8.tmp 100 PID 3684 wrote to memory of 5152 3684 1A74.tmp 101 PID 5152 wrote to memory of 3232 5152 1B00.tmp 102 PID 3232 wrote to memory of 1872 3232 1BCB.tmp 103 PID 1872 wrote to memory of 724 1872 1CA6.tmp 104 PID 724 wrote to memory of 5684 724 1D13.tmp 105 PID 5684 wrote to memory of 2656 5684 1DBF.tmp 106 PID 2656 wrote to memory of 2644 2656 1E8A.tmp 107 PID 2644 wrote to memory of 4120 2644 1F36.tmp 108 PID 4120 wrote to memory of 5916 4120 1FE2.tmp 109 PID 5916 wrote to memory of 5340 5916 20BD.tmp 110 PID 5340 wrote to memory of 3408 5340 2198.tmp 111 PID 3408 wrote to memory of 5664 3408 2253.tmp 112 PID 5664 wrote to memory of 3436 5664 230F.tmp 113 PID 3436 wrote to memory of 240 3436 2409.tmp 114 PID 240 wrote to memory of 300 240 24C4.tmp 115 PID 300 wrote to memory of 5464 300 2580.tmp 116 PID 5464 wrote to memory of 1700 5464 267A.tmp 117 PID 1700 wrote to memory of 1576 1700 2745.tmp 118 PID 1576 wrote to memory of 5304 1576 2820.tmp 119 PID 5304 wrote to memory of 1392 5304 28DB.tmp 120 PID 1392 wrote to memory of 5472 1392 2948.tmp 121 PID 5472 wrote to memory of 1588 5472 29C5.tmp 122 PID 1588 wrote to memory of 3812 1588 2A62.tmp 123 PID 3812 wrote to memory of 4464 3812 2ADF.tmp 124 PID 4464 wrote to memory of 2416 4464 2B7B.tmp 125 PID 2416 wrote to memory of 2060 2416 2C08.tmp 126 PID 2060 wrote to memory of 4576 2060 2C94.tmp 127 PID 4576 wrote to memory of 4492 4576 2D21.tmp 128 PID 4492 wrote to memory of 1320 4492 2DAD.tmp 129 PID 1320 wrote to memory of 2084 1320 2E2A.tmp 130 PID 2084 wrote to memory of 2068 2084 2EA7.tmp 131 PID 2068 wrote to memory of 5388 2068 2F34.tmp 132 PID 5388 wrote to memory of 3112 5388 2FA1.tmp 133 PID 3112 wrote to memory of 1100 3112 301E.tmp 134 PID 1100 wrote to memory of 5208 1100 309B.tmp 135 PID 5208 wrote to memory of 3340 5208 3118.tmp 136 PID 3340 wrote to memory of 1632 3340 31B5.tmp 137 PID 1632 wrote to memory of 3604 1632 3241.tmp 138 PID 3604 wrote to memory of 5088 3604 32BE.tmp 139 PID 5088 wrote to memory of 936 5088 337A.tmp 140 PID 936 wrote to memory of 916 936 3416.tmp 141 PID 916 wrote to memory of 5740 916 34A3.tmp 142 PID 5740 wrote to memory of 5312 5740 354F.tmp 143 PID 5312 wrote to memory of 4324 5312 35CC.tmp 144 PID 4324 wrote to memory of 6016 4324 3649.tmp 145 PID 6016 wrote to memory of 1368 6016 36E5.tmp 146 PID 1368 wrote to memory of 5640 1368 3791.tmp 147 PID 5640 wrote to memory of 2192 5640 382D.tmp 148 PID 2192 wrote to memory of 5996 2192 38C9.tmp 149 PID 5996 wrote to memory of 3712 5996 3946.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_1dcf55c6eb192ba01e31bd558b0e6a11_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_1dcf55c6eb192ba01e31bd558b0e6a11_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\FC5.tmp"C:\Users\Admin\AppData\Local\Temp\FC5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\1081.tmp"C:\Users\Admin\AppData\Local\Temp\1081.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\117B.tmp"C:\Users\Admin\AppData\Local\Temp\117B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\1294.tmp"C:\Users\Admin\AppData\Local\Temp\1294.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\135F.tmp"C:\Users\Admin\AppData\Local\Temp\135F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\1488.tmp"C:\Users\Admin\AppData\Local\Temp\1488.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\1505.tmp"C:\Users\Admin\AppData\Local\Temp\1505.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\160F.tmp"C:\Users\Admin\AppData\Local\Temp\160F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\16F9.tmp"C:\Users\Admin\AppData\Local\Temp\16F9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1A74.tmp"C:\Users\Admin\AppData\Local\Temp\1A74.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\1CA6.tmp"C:\Users\Admin\AppData\Local\Temp\1CA6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1D13.tmp"C:\Users\Admin\AppData\Local\Temp\1D13.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1F36.tmp"C:\Users\Admin\AppData\Local\Temp\1F36.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1FE2.tmp"C:\Users\Admin\AppData\Local\Temp\1FE2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\20BD.tmp"C:\Users\Admin\AppData\Local\Temp\20BD.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\2198.tmp"C:\Users\Admin\AppData\Local\Temp\2198.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\2253.tmp"C:\Users\Admin\AppData\Local\Temp\2253.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\230F.tmp"C:\Users\Admin\AppData\Local\Temp\230F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\2409.tmp"C:\Users\Admin\AppData\Local\Temp\2409.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\2580.tmp"C:\Users\Admin\AppData\Local\Temp\2580.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\267A.tmp"C:\Users\Admin\AppData\Local\Temp\267A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\2745.tmp"C:\Users\Admin\AppData\Local\Temp\2745.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\28DB.tmp"C:\Users\Admin\AppData\Local\Temp\28DB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\2948.tmp"C:\Users\Admin\AppData\Local\Temp\2948.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\29C5.tmp"C:\Users\Admin\AppData\Local\Temp\29C5.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\2A62.tmp"C:\Users\Admin\AppData\Local\Temp\2A62.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\2C94.tmp"C:\Users\Admin\AppData\Local\Temp\2C94.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\2D21.tmp"C:\Users\Admin\AppData\Local\Temp\2D21.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\2F34.tmp"C:\Users\Admin\AppData\Local\Temp\2F34.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\301E.tmp"C:\Users\Admin\AppData\Local\Temp\301E.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\309B.tmp"C:\Users\Admin\AppData\Local\Temp\309B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\3118.tmp"C:\Users\Admin\AppData\Local\Temp\3118.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\31B5.tmp"C:\Users\Admin\AppData\Local\Temp\31B5.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\3241.tmp"C:\Users\Admin\AppData\Local\Temp\3241.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\32BE.tmp"C:\Users\Admin\AppData\Local\Temp\32BE.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\337A.tmp"C:\Users\Admin\AppData\Local\Temp\337A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\34A3.tmp"C:\Users\Admin\AppData\Local\Temp\34A3.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\354F.tmp"C:\Users\Admin\AppData\Local\Temp\354F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\35CC.tmp"C:\Users\Admin\AppData\Local\Temp\35CC.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\3649.tmp"C:\Users\Admin\AppData\Local\Temp\3649.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\36E5.tmp"C:\Users\Admin\AppData\Local\Temp\36E5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\3791.tmp"C:\Users\Admin\AppData\Local\Temp\3791.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\382D.tmp"C:\Users\Admin\AppData\Local\Temp\382D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\38C9.tmp"C:\Users\Admin\AppData\Local\Temp\38C9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\3946.tmp"C:\Users\Admin\AppData\Local\Temp\3946.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\39D3.tmp"C:\Users\Admin\AppData\Local\Temp\39D3.tmp"65⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\3A50.tmp"C:\Users\Admin\AppData\Local\Temp\3A50.tmp"66⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"67⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\3B79.tmp"C:\Users\Admin\AppData\Local\Temp\3B79.tmp"68⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\3C34.tmp"C:\Users\Admin\AppData\Local\Temp\3C34.tmp"69⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"70⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"71⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\3E09.tmp"C:\Users\Admin\AppData\Local\Temp\3E09.tmp"72⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"73⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\3F41.tmp"C:\Users\Admin\AppData\Local\Temp\3F41.tmp"74⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"75⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"76⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\40F7.tmp"C:\Users\Admin\AppData\Local\Temp\40F7.tmp"77⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"78⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\4210.tmp"C:\Users\Admin\AppData\Local\Temp\4210.tmp"79⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\429D.tmp"C:\Users\Admin\AppData\Local\Temp\429D.tmp"80⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\430A.tmp"C:\Users\Admin\AppData\Local\Temp\430A.tmp"81⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\4397.tmp"C:\Users\Admin\AppData\Local\Temp\4397.tmp"82⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\4414.tmp"C:\Users\Admin\AppData\Local\Temp\4414.tmp"83⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\44A0.tmp"C:\Users\Admin\AppData\Local\Temp\44A0.tmp"84⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\452D.tmp"C:\Users\Admin\AppData\Local\Temp\452D.tmp"85⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"86⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\4656.tmp"C:\Users\Admin\AppData\Local\Temp\4656.tmp"87⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\46D3.tmp"C:\Users\Admin\AppData\Local\Temp\46D3.tmp"88⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\4760.tmp"C:\Users\Admin\AppData\Local\Temp\4760.tmp"89⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"90⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"91⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\4925.tmp"C:\Users\Admin\AppData\Local\Temp\4925.tmp"92⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\49A2.tmp"C:\Users\Admin\AppData\Local\Temp\49A2.tmp"93⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"94⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"95⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\4B38.tmp"C:\Users\Admin\AppData\Local\Temp\4B38.tmp"96⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"97⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\4C51.tmp"C:\Users\Admin\AppData\Local\Temp\4C51.tmp"98⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\4CED.tmp"C:\Users\Admin\AppData\Local\Temp\4CED.tmp"99⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"100⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\4E07.tmp"C:\Users\Admin\AppData\Local\Temp\4E07.tmp"101⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\4E84.tmp"C:\Users\Admin\AppData\Local\Temp\4E84.tmp"102⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\4F20.tmp"C:\Users\Admin\AppData\Local\Temp\4F20.tmp"103⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"104⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\5049.tmp"C:\Users\Admin\AppData\Local\Temp\5049.tmp"105⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\50D5.tmp"C:\Users\Admin\AppData\Local\Temp\50D5.tmp"106⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\5152.tmp"C:\Users\Admin\AppData\Local\Temp\5152.tmp"107⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\51CF.tmp"C:\Users\Admin\AppData\Local\Temp\51CF.tmp"108⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\523D.tmp"C:\Users\Admin\AppData\Local\Temp\523D.tmp"109⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\52C9.tmp"C:\Users\Admin\AppData\Local\Temp\52C9.tmp"110⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\5366.tmp"C:\Users\Admin\AppData\Local\Temp\5366.tmp"111⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\53E3.tmp"C:\Users\Admin\AppData\Local\Temp\53E3.tmp"112⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\546F.tmp"C:\Users\Admin\AppData\Local\Temp\546F.tmp"113⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\54DD.tmp"C:\Users\Admin\AppData\Local\Temp\54DD.tmp"114⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\5569.tmp"C:\Users\Admin\AppData\Local\Temp\5569.tmp"115⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\55D7.tmp"C:\Users\Admin\AppData\Local\Temp\55D7.tmp"116⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\5663.tmp"C:\Users\Admin\AppData\Local\Temp\5663.tmp"117⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\570F.tmp"C:\Users\Admin\AppData\Local\Temp\570F.tmp"118⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\577D.tmp"C:\Users\Admin\AppData\Local\Temp\577D.tmp"119⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\57EA.tmp"C:\Users\Admin\AppData\Local\Temp\57EA.tmp"120⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\5877.tmp"C:\Users\Admin\AppData\Local\Temp\5877.tmp"121⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\5903.tmp"C:\Users\Admin\AppData\Local\Temp\5903.tmp"122⤵PID:4816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-