Analysis
- max time kernel
130s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 03:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_65d91b2838f1a78fdc3643d2d36158e1_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_65d91b2838f1a78fdc3643d2d36158e1_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260706-en
3 signatures
150 seconds
General
- Target 2026-07-06_65d91b2838f1a78fdc3643d2d36158e1_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260707-dvtffagy5y
- SHA256 0fe3821d6bb821906313192ddd716092b9d8269692a3760b52639db2ccd64b6d
- MD5 65d91b2838f1a78fdc3643d2d36158e1
- SHA1 e37b01706c5b9fadfee6885b173f1ad2054a7499
- SHA512 d489232b40654a090bcc2dc2cf958219dbae0b66363664770ebb42a0d5b45d0aa5c22eced1a14919d2195dddb4a70ac8560ff412c99e8c9bc392cec587d75668
- SSDEEP 12288:wU5rCOTeiDBNVlFzpm3C0vO+jLbj0NZ+3/v+I9hUG2VA:wUQOJDBNVlFFhujLbwNGEA
- TLSH T12AE4D02177D88536E5FB037859B5E6604D7EBD229722D6DF2F8021AE0AB1BC0D670723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2884 E692.tmp 2720 E7AC.tmp 2836 E867.tmp 2416 E9A0.tmp 6004 EA9A.tmp 1492 EBB3.tmp 5716 ECBC.tmp 1896 EDE5.tmp 2484 EEA1.tmp 1120 EF0E.tmp 5672 F076.tmp 3600 F150.tmp 5836 F24A.tmp 2516 F373.tmp 5500 F46D.tmp 4176 F596.tmp 4496 F661.tmp 1672 F7A9.tmp 2860 F8E2.tmp 4532 F9CC.tmp 800 FAA7.tmp 4684 FC3D.tmp 4996 FD37.tmp 5972 FE70.tmp 6140 FF5A.tmp 404 C1.tmp 5860 248.tmp 3320 332.tmp 3772 42C.tmp 4288 526.tmp 3184 630.tmp 3004 749.tmp 2212 853.tmp 4168 8FF.tmp 5600 9DA.tmp 1156 A85.tmp 3960 B41.tmp 1332 BDD.tmp 4740 CA8.tmp 2044 D73.tmp 1296 E3F.tmp 4648 EFA.tmp 4660 FC5.tmp 4616 1071.tmp 6048 111D.tmp 3572 11B9.tmp 1424 1275.tmp 4208 1340.tmp 2448 13EC.tmp 2872 1469.tmp 1832 14E6.tmp 4980 1563.tmp 764 15E0.tmp 2952 165D.tmp 3324 16DA.tmp 5184 1757.tmp 3488 17C4.tmp 2600 1860.tmp 1680 18FD.tmp 2920 1989.tmp 3588 1A83.tmp 4456 1B00.tmp 1036 1B6E.tmp 5720 1BEB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 477F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 128F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E238.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A260.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 545B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3167.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D533.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1071.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2476.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A818.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7FC.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4268 wrote to memory of 2884 4268 2026-07-06_65d91b2838f1a78fdc3643d2d36158e1_elex_mafia_stealc_tofsee.exe 87 PID 2884 wrote to memory of 2720 2884 E692.tmp 88 PID 2720 wrote to memory of 2836 2720 E7AC.tmp 89 PID 2836 wrote to memory of 2416 2836 E867.tmp 90 PID 2416 wrote to memory of 6004 2416 E9A0.tmp 91 PID 6004 wrote to memory of 1492 6004 EA9A.tmp 92 PID 1492 wrote to memory of 5716 1492 EBB3.tmp 93 PID 5716 wrote to memory of 1896 5716 ECBC.tmp 94 PID 1896 wrote to memory of 2484 1896 EDE5.tmp 95 PID 2484 wrote to memory of 1120 2484 EEA1.tmp 96 PID 1120 wrote to memory of 5672 1120 EF0E.tmp 97 PID 5672 wrote to memory of 3600 5672 F076.tmp 98 PID 3600 wrote to memory of 5836 3600 F150.tmp 99 PID 5836 wrote to memory of 2516 5836 F24A.tmp 100 PID 2516 wrote to memory of 5500 2516 F373.tmp 101 PID 5500 wrote to memory of 4176 5500 F46D.tmp 102 PID 4176 wrote to memory of 4496 4176 F596.tmp 103 PID 4496 wrote to memory of 1672 4496 F661.tmp 104 PID 1672 wrote to memory of 2860 1672 F7A9.tmp 105 PID 2860 wrote to memory of 4532 2860 F8E2.tmp 106 PID 4532 wrote to memory of 800 4532 F9CC.tmp 107 PID 800 wrote to memory of 4684 800 FAA7.tmp 108 PID 4684 wrote to memory of 4996 4684 FC3D.tmp 109 PID 4996 wrote to memory of 5972 4996 FD37.tmp 110 PID 5972 wrote to memory of 6140 5972 FE70.tmp 111 PID 6140 wrote to memory of 404 6140 FF5A.tmp 112 PID 404 wrote to memory of 5860 404 C1.tmp 113 PID 5860 wrote to memory of 3320 5860 248.tmp 114 PID 3320 wrote to memory of 3772 3320 332.tmp 115 PID 3772 wrote to memory of 4288 3772 42C.tmp 116 PID 4288 wrote to memory of 3184 4288 526.tmp 117 PID 3184 wrote to memory of 3004 3184 630.tmp 118 PID 3004 wrote to memory of 2212 3004 749.tmp 119 PID 2212 wrote to memory of 4168 2212 853.tmp 120 PID 4168 wrote to memory of 5600 4168 8FF.tmp 121 PID 5600 wrote to memory of 1156 5600 9DA.tmp 122 PID 1156 wrote to memory of 3960 1156 A85.tmp 123 PID 3960 wrote to memory of 1332 3960 B41.tmp 124 PID 1332 wrote to memory of 4740 1332 BDD.tmp 125 PID 4740 wrote to memory of 2044 4740 CA8.tmp 126 PID 2044 wrote to memory of 1296 2044 D73.tmp 127 PID 1296 wrote to memory of 4648 1296 E3F.tmp 128 PID 4648 wrote to memory of 4660 4648 EFA.tmp 129 PID 4660 wrote to memory of 4616 4660 FC5.tmp 130 PID 4616 wrote to memory of 6048 4616 1071.tmp 131 PID 6048 wrote to memory of 3572 6048 111D.tmp 132 PID 3572 wrote to memory of 1424 3572 11B9.tmp 133 PID 1424 wrote to memory of 4208 1424 1275.tmp 134 PID 4208 wrote to memory of 2448 4208 1340.tmp 135 PID 2448 wrote to memory of 2872 2448 13EC.tmp 136 PID 2872 wrote to memory of 1832 2872 1469.tmp 137 PID 1832 wrote to memory of 4980 1832 14E6.tmp 138 PID 4980 wrote to memory of 764 4980 1563.tmp 139 PID 764 wrote to memory of 2952 764 15E0.tmp 140 PID 2952 wrote to memory of 3324 2952 165D.tmp 141 PID 3324 wrote to memory of 5184 3324 16DA.tmp 142 PID 5184 wrote to memory of 3488 5184 1757.tmp 143 PID 3488 wrote to memory of 2600 3488 17C4.tmp 144 PID 2600 wrote to memory of 1680 2600 1860.tmp 145 PID 1680 wrote to memory of 2920 1680 18FD.tmp 146 PID 5916 wrote to memory of 3588 5916 19F7.tmp 148 PID 3588 wrote to memory of 4456 3588 1A83.tmp 149 PID 4456 wrote to memory of 1036 4456 1B00.tmp 150 PID 1036 wrote to memory of 5720 1036 1B6E.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_65d91b2838f1a78fdc3643d2d36158e1_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_65d91b2838f1a78fdc3643d2d36158e1_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\E867.tmp"C:\Users\Admin\AppData\Local\Temp\E867.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\ECBC.tmp"C:\Users\Admin\AppData\Local\Temp\ECBC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\EDE5.tmp"C:\Users\Admin\AppData\Local\Temp\EDE5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\EEA1.tmp"C:\Users\Admin\AppData\Local\Temp\EEA1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\F076.tmp"C:\Users\Admin\AppData\Local\Temp\F076.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\F150.tmp"C:\Users\Admin\AppData\Local\Temp\F150.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\F24A.tmp"C:\Users\Admin\AppData\Local\Temp\F24A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\F373.tmp"C:\Users\Admin\AppData\Local\Temp\F373.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\F596.tmp"C:\Users\Admin\AppData\Local\Temp\F596.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\F661.tmp"C:\Users\Admin\AppData\Local\Temp\F661.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\FAA7.tmp"C:\Users\Admin\AppData\Local\Temp\FAA7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\FC3D.tmp"C:\Users\Admin\AppData\Local\Temp\FC3D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\FD37.tmp"C:\Users\Admin\AppData\Local\Temp\FD37.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\FE70.tmp"C:\Users\Admin\AppData\Local\Temp\FE70.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\FF5A.tmp"C:\Users\Admin\AppData\Local\Temp\FF5A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\C1.tmp"C:\Users\Admin\AppData\Local\Temp\C1.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\248.tmp"C:\Users\Admin\AppData\Local\Temp\248.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\332.tmp"C:\Users\Admin\AppData\Local\Temp\332.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\42C.tmp"C:\Users\Admin\AppData\Local\Temp\42C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\526.tmp"C:\Users\Admin\AppData\Local\Temp\526.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\749.tmp"C:\Users\Admin\AppData\Local\Temp\749.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\853.tmp"C:\Users\Admin\AppData\Local\Temp\853.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\8FF.tmp"C:\Users\Admin\AppData\Local\Temp\8FF.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\9DA.tmp"C:\Users\Admin\AppData\Local\Temp\9DA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\A85.tmp"C:\Users\Admin\AppData\Local\Temp\A85.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\B41.tmp"C:\Users\Admin\AppData\Local\Temp\B41.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\BDD.tmp"C:\Users\Admin\AppData\Local\Temp\BDD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\CA8.tmp"C:\Users\Admin\AppData\Local\Temp\CA8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\D73.tmp"C:\Users\Admin\AppData\Local\Temp\D73.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\E3F.tmp"C:\Users\Admin\AppData\Local\Temp\E3F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\EFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFA.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\FC5.tmp"C:\Users\Admin\AppData\Local\Temp\FC5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\1071.tmp"C:\Users\Admin\AppData\Local\Temp\1071.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\111D.tmp"C:\Users\Admin\AppData\Local\Temp\111D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\11B9.tmp"C:\Users\Admin\AppData\Local\Temp\11B9.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\1275.tmp"C:\Users\Admin\AppData\Local\Temp\1275.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\1340.tmp"C:\Users\Admin\AppData\Local\Temp\1340.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\13EC.tmp"C:\Users\Admin\AppData\Local\Temp\13EC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1469.tmp"C:\Users\Admin\AppData\Local\Temp\1469.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\14E6.tmp"C:\Users\Admin\AppData\Local\Temp\14E6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\1563.tmp"C:\Users\Admin\AppData\Local\Temp\1563.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\15E0.tmp"C:\Users\Admin\AppData\Local\Temp\15E0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\165D.tmp"C:\Users\Admin\AppData\Local\Temp\165D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\16DA.tmp"C:\Users\Admin\AppData\Local\Temp\16DA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\1757.tmp"C:\Users\Admin\AppData\Local\Temp\1757.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\1860.tmp"C:\Users\Admin\AppData\Local\Temp\1860.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"61⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\19F7.tmp"C:\Users\Admin\AppData\Local\Temp\19F7.tmp"62⤵
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\1B6E.tmp"C:\Users\Admin\AppData\Local\Temp\1B6E.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"66⤵
- Executes dropped EXE
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\1C68.tmp"C:\Users\Admin\AppData\Local\Temp\1C68.tmp"67⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"68⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\1D62.tmp"C:\Users\Admin\AppData\Local\Temp\1D62.tmp"69⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"70⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"71⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\1F07.tmp"C:\Users\Admin\AppData\Local\Temp\1F07.tmp"72⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\1F84.tmp"C:\Users\Admin\AppData\Local\Temp\1F84.tmp"73⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"74⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\208E.tmp"C:\Users\Admin\AppData\Local\Temp\208E.tmp"75⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\210B.tmp"C:\Users\Admin\AppData\Local\Temp\210B.tmp"76⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\2188.tmp"C:\Users\Admin\AppData\Local\Temp\2188.tmp"77⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\2205.tmp"C:\Users\Admin\AppData\Local\Temp\2205.tmp"78⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2282.tmp"C:\Users\Admin\AppData\Local\Temp\2282.tmp"79⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\22EF.tmp"C:\Users\Admin\AppData\Local\Temp\22EF.tmp"80⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\236C.tmp"C:\Users\Admin\AppData\Local\Temp\236C.tmp"81⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\23F9.tmp"C:\Users\Admin\AppData\Local\Temp\23F9.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\2476.tmp"C:\Users\Admin\AppData\Local\Temp\2476.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\24F3.tmp"C:\Users\Admin\AppData\Local\Temp\24F3.tmp"84⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\2570.tmp"C:\Users\Admin\AppData\Local\Temp\2570.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\25FD.tmp"C:\Users\Admin\AppData\Local\Temp\25FD.tmp"86⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\266A.tmp"C:\Users\Admin\AppData\Local\Temp\266A.tmp"87⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\26F7.tmp"C:\Users\Admin\AppData\Local\Temp\26F7.tmp"88⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\2774.tmp"C:\Users\Admin\AppData\Local\Temp\2774.tmp"89⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2800.tmp"C:\Users\Admin\AppData\Local\Temp\2800.tmp"90⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\286E.tmp"C:\Users\Admin\AppData\Local\Temp\286E.tmp"91⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\28EB.tmp"C:\Users\Admin\AppData\Local\Temp\28EB.tmp"92⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"93⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\29E5.tmp"C:\Users\Admin\AppData\Local\Temp\29E5.tmp"94⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\2A52.tmp"C:\Users\Admin\AppData\Local\Temp\2A52.tmp"95⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"96⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\2B6B.tmp"C:\Users\Admin\AppData\Local\Temp\2B6B.tmp"97⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"98⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\2C85.tmp"C:\Users\Admin\AppData\Local\Temp\2C85.tmp"99⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\2D11.tmp"C:\Users\Admin\AppData\Local\Temp\2D11.tmp"100⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"101⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"102⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\2E98.tmp"C:\Users\Admin\AppData\Local\Temp\2E98.tmp"103⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2F15.tmp"C:\Users\Admin\AppData\Local\Temp\2F15.tmp"104⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2F92.tmp"C:\Users\Admin\AppData\Local\Temp\2F92.tmp"105⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\301E.tmp"C:\Users\Admin\AppData\Local\Temp\301E.tmp"106⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\308C.tmp"C:\Users\Admin\AppData\Local\Temp\308C.tmp"107⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\3109.tmp"C:\Users\Admin\AppData\Local\Temp\3109.tmp"108⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\3167.tmp"C:\Users\Admin\AppData\Local\Temp\3167.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\31D4.tmp"C:\Users\Admin\AppData\Local\Temp\31D4.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\3270.tmp"C:\Users\Admin\AppData\Local\Temp\3270.tmp"111⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\32ED.tmp"C:\Users\Admin\AppData\Local\Temp\32ED.tmp"112⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\336A.tmp"C:\Users\Admin\AppData\Local\Temp\336A.tmp"113⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\33E7.tmp"C:\Users\Admin\AppData\Local\Temp\33E7.tmp"114⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\3464.tmp"C:\Users\Admin\AppData\Local\Temp\3464.tmp"115⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\34F1.tmp"C:\Users\Admin\AppData\Local\Temp\34F1.tmp"116⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\356E.tmp"C:\Users\Admin\AppData\Local\Temp\356E.tmp"117⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\35FA.tmp"C:\Users\Admin\AppData\Local\Temp\35FA.tmp"118⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\3677.tmp"C:\Users\Admin\AppData\Local\Temp\3677.tmp"119⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\36E5.tmp"C:\Users\Admin\AppData\Local\Temp\36E5.tmp"120⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\3771.tmp"C:\Users\Admin\AppData\Local\Temp\3771.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"122⤵PID:6112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-