Analysis
- max time kernel
120s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 07:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_cb7ba9384946f0c8f7117727fc3cd366_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_cb7ba9384946f0c8f7117727fc3cd366_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260706-en
3 signatures
150 seconds
General
- Target 2026-07-09_cb7ba9384946f0c8f7117727fc3cd366_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260709-jvbtaaew5k
- SHA256 414c7b73f700620157ec0aab050a162614c7527d62e9e0b33da4cb4bf63cd8f5
- MD5 cb7ba9384946f0c8f7117727fc3cd366
- SHA1 74f5d536939ffcf1d5ff4634df0b11d23f7e5a8c
- SHA512 c6e51defb728dbe2e4c49162fe74817613a45aab3232fa2ee0cda3dc05a849fbf9bc017495e07be8f4a4610c8d70bc2e9ef0c2e4aa6db17ef602f6e497b49c00
- SSDEEP 12288:9U5rCOTei6mThs8MJ/A9CcCKw7tvVnXAcqZoXWjdq:9UQOJ6c4/kw7LXAcqqGh
- TLSH T16EC4F121B585C032EAE202704EE2EBB2197ABC355722A4C77BD4776D2FB06E1D674347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3736 8EAA.tmp 3588 8FD2.tmp 2644 90BD.tmp 5456 912A.tmp 1812 91C6.tmp 2764 9263.tmp 5412 92FF.tmp 4660 93AB.tmp 5960 9486.tmp 5164 9560.tmp 3516 95BE.tmp 3880 967A.tmp 5360 9716.tmp 1560 97C2.tmp 1496 989C.tmp 5812 9939.tmp 3968 9A23.tmp 1572 9AB0.tmp 4024 9B5C.tmp 2924 9BE8.tmp 4476 9CB3.tmp 4132 9D40.tmp 5844 9DFB.tmp 1884 9EB7.tmp 5900 9F53.tmp 5944 9FEF.tmp 4840 A0CA.tmp 2412 A166.tmp 5896 A203.tmp 5512 A2BE.tmp 4932 A35A.tmp 360 A3F7.tmp 408 A493.tmp 4884 A520.tmp 4060 A59D.tmp 4756 A629.tmp 3496 A6A6.tmp 3896 A723.tmp 2624 A7A0.tmp 4184 A82D.tmp 4692 A8AA.tmp 3188 A927.tmp 1688 A994.tmp 4684 AA11.tmp 3488 AA7F.tmp 5036 AB1B.tmp 1524 ABA7.tmp 1164 AC44.tmp 6120 ACB1.tmp 5664 AD3E.tmp 5924 ADDA.tmp 2252 AE47.tmp 5020 AEC4.tmp 712 AF41.tmp 4904 AFCE.tmp 1924 B05B.tmp 5228 B0D8.tmp 6104 B164.tmp 4864 B200.tmp 4548 B28D.tmp 1936 B397.tmp 4212 B433.tmp 3060 B4CF.tmp 2744 B54C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3058.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 318C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4070.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 708E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 104D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 956B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 394C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A559.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B622.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 218E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 533D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9665.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9486.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D99D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B24A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C67E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E18.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1208 wrote to memory of 3736 1208 2026-07-09_cb7ba9384946f0c8f7117727fc3cd366_elex_mafia_stealc_tofsee.exe 87 PID 3736 wrote to memory of 3588 3736 8EAA.tmp 88 PID 3588 wrote to memory of 2644 3588 8FD2.tmp 89 PID 2644 wrote to memory of 5456 2644 90BD.tmp 90 PID 5456 wrote to memory of 1812 5456 912A.tmp 91 PID 1812 wrote to memory of 2764 1812 91C6.tmp 92 PID 2764 wrote to memory of 5412 2764 9263.tmp 93 PID 5412 wrote to memory of 4660 5412 92FF.tmp 94 PID 4660 wrote to memory of 5960 4660 93AB.tmp 95 PID 5960 wrote to memory of 5164 5960 9486.tmp 96 PID 5164 wrote to memory of 3516 5164 9560.tmp 97 PID 3516 wrote to memory of 3880 3516 95BE.tmp 98 PID 3880 wrote to memory of 5360 3880 967A.tmp 99 PID 5360 wrote to memory of 1560 5360 9716.tmp 100 PID 1560 wrote to memory of 1496 1560 97C2.tmp 101 PID 1496 wrote to memory of 5812 1496 989C.tmp 102 PID 5812 wrote to memory of 3968 5812 9939.tmp 103 PID 3968 wrote to memory of 1572 3968 9A23.tmp 104 PID 1572 wrote to memory of 4024 1572 9AB0.tmp 105 PID 4024 wrote to memory of 2924 4024 9B5C.tmp 106 PID 2924 wrote to memory of 4476 2924 9BE8.tmp 107 PID 4476 wrote to memory of 4132 4476 9CB3.tmp 108 PID 4132 wrote to memory of 5844 4132 9D40.tmp 109 PID 5844 wrote to memory of 1884 5844 9DFB.tmp 110 PID 1884 wrote to memory of 5900 1884 9EB7.tmp 111 PID 5900 wrote to memory of 5944 5900 9F53.tmp 112 PID 5944 wrote to memory of 4840 5944 9FEF.tmp 113 PID 4840 wrote to memory of 2412 4840 A0CA.tmp 114 PID 2412 wrote to memory of 5896 2412 A166.tmp 115 PID 5896 wrote to memory of 5512 5896 A203.tmp 116 PID 5512 wrote to memory of 4932 5512 A2BE.tmp 117 PID 4932 wrote to memory of 360 4932 A35A.tmp 118 PID 360 wrote to memory of 408 360 A3F7.tmp 119 PID 408 wrote to memory of 4884 408 A493.tmp 120 PID 4884 wrote to memory of 4060 4884 A520.tmp 121 PID 4060 wrote to memory of 4756 4060 A59D.tmp 122 PID 4756 wrote to memory of 3496 4756 A629.tmp 123 PID 3496 wrote to memory of 3896 3496 A6A6.tmp 124 PID 3896 wrote to memory of 2624 3896 A723.tmp 125 PID 2624 wrote to memory of 4184 2624 A7A0.tmp 126 PID 4184 wrote to memory of 4692 4184 A82D.tmp 127 PID 4692 wrote to memory of 3188 4692 A8AA.tmp 128 PID 3188 wrote to memory of 1688 3188 A927.tmp 129 PID 1688 wrote to memory of 4684 1688 A994.tmp 130 PID 4684 wrote to memory of 3488 4684 AA11.tmp 131 PID 3488 wrote to memory of 5036 3488 AA7F.tmp 132 PID 5036 wrote to memory of 1524 5036 AB1B.tmp 133 PID 1524 wrote to memory of 1164 1524 ABA7.tmp 134 PID 1164 wrote to memory of 6120 1164 AC44.tmp 135 PID 6120 wrote to memory of 5664 6120 ACB1.tmp 136 PID 5664 wrote to memory of 5924 5664 AD3E.tmp 137 PID 5924 wrote to memory of 2252 5924 ADDA.tmp 138 PID 2252 wrote to memory of 5020 2252 AE47.tmp 139 PID 5020 wrote to memory of 712 5020 AEC4.tmp 140 PID 712 wrote to memory of 4904 712 AF41.tmp 141 PID 4904 wrote to memory of 1924 4904 AFCE.tmp 142 PID 1924 wrote to memory of 5228 1924 B05B.tmp 143 PID 5228 wrote to memory of 6104 5228 B0D8.tmp 144 PID 6104 wrote to memory of 4864 6104 B164.tmp 145 PID 4864 wrote to memory of 4548 4864 B200.tmp 146 PID 5656 wrote to memory of 1936 5656 B2FA.tmp 148 PID 1936 wrote to memory of 4212 1936 B397.tmp 149 PID 4212 wrote to memory of 3060 4212 B433.tmp 150 PID 3060 wrote to memory of 2744 3060 B4CF.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_cb7ba9384946f0c8f7117727fc3cd366_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_cb7ba9384946f0c8f7117727fc3cd366_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\90BD.tmp"C:\Users\Admin\AppData\Local\Temp\90BD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\912A.tmp"C:\Users\Admin\AppData\Local\Temp\912A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\91C6.tmp"C:\Users\Admin\AppData\Local\Temp\91C6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\9263.tmp"C:\Users\Admin\AppData\Local\Temp\9263.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\92FF.tmp"C:\Users\Admin\AppData\Local\Temp\92FF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\93AB.tmp"C:\Users\Admin\AppData\Local\Temp\93AB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\9486.tmp"C:\Users\Admin\AppData\Local\Temp\9486.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\9560.tmp"C:\Users\Admin\AppData\Local\Temp\9560.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\967A.tmp"C:\Users\Admin\AppData\Local\Temp\967A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\9716.tmp"C:\Users\Admin\AppData\Local\Temp\9716.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\97C2.tmp"C:\Users\Admin\AppData\Local\Temp\97C2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\989C.tmp"C:\Users\Admin\AppData\Local\Temp\989C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\9939.tmp"C:\Users\Admin\AppData\Local\Temp\9939.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\9A23.tmp"C:\Users\Admin\AppData\Local\Temp\9A23.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\9D40.tmp"C:\Users\Admin\AppData\Local\Temp\9D40.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\9EB7.tmp"C:\Users\Admin\AppData\Local\Temp\9EB7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\9F53.tmp"C:\Users\Admin\AppData\Local\Temp\9F53.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\A166.tmp"C:\Users\Admin\AppData\Local\Temp\A166.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\A203.tmp"C:\Users\Admin\AppData\Local\Temp\A203.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\A35A.tmp"C:\Users\Admin\AppData\Local\Temp\A35A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\A493.tmp"C:\Users\Admin\AppData\Local\Temp\A493.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\A520.tmp"C:\Users\Admin\AppData\Local\Temp\A520.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\A59D.tmp"C:\Users\Admin\AppData\Local\Temp\A59D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\A629.tmp"C:\Users\Admin\AppData\Local\Temp\A629.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\A6A6.tmp"C:\Users\Admin\AppData\Local\Temp\A6A6.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\A723.tmp"C:\Users\Admin\AppData\Local\Temp\A723.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\A7A0.tmp"C:\Users\Admin\AppData\Local\Temp\A7A0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\A82D.tmp"C:\Users\Admin\AppData\Local\Temp\A82D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\A927.tmp"C:\Users\Admin\AppData\Local\Temp\A927.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\A994.tmp"C:\Users\Admin\AppData\Local\Temp\A994.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\AA11.tmp"C:\Users\Admin\AppData\Local\Temp\AA11.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\AB1B.tmp"C:\Users\Admin\AppData\Local\Temp\AB1B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\AC44.tmp"C:\Users\Admin\AppData\Local\Temp\AC44.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\AE47.tmp"C:\Users\Admin\AppData\Local\Temp\AE47.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\AF41.tmp"C:\Users\Admin\AppData\Local\Temp\AF41.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\AFCE.tmp"C:\Users\Admin\AppData\Local\Temp\AFCE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\B164.tmp"C:\Users\Admin\AppData\Local\Temp\B164.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\B200.tmp"C:\Users\Admin\AppData\Local\Temp\B200.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"61⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"62⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\B397.tmp"C:\Users\Admin\AppData\Local\Temp\B397.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\B433.tmp"C:\Users\Admin\AppData\Local\Temp\B433.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\B54C.tmp"C:\Users\Admin\AppData\Local\Temp\B54C.tmp"66⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"67⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\B665.tmp"C:\Users\Admin\AppData\Local\Temp\B665.tmp"68⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\B6E2.tmp"C:\Users\Admin\AppData\Local\Temp\B6E2.tmp"69⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\B75F.tmp"C:\Users\Admin\AppData\Local\Temp\B75F.tmp"70⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"71⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\B859.tmp"C:\Users\Admin\AppData\Local\Temp\B859.tmp"72⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"73⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\B963.tmp"C:\Users\Admin\AppData\Local\Temp\B963.tmp"74⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"75⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"76⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\BACA.tmp"C:\Users\Admin\AppData\Local\Temp\BACA.tmp"77⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\BB86.tmp"C:\Users\Admin\AppData\Local\Temp\BB86.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:972 -
C:\Users\Admin\AppData\Local\Temp\BC03.tmp"C:\Users\Admin\AppData\Local\Temp\BC03.tmp"79⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\BC80.tmp"C:\Users\Admin\AppData\Local\Temp\BC80.tmp"80⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"81⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\BE07.tmp"C:\Users\Admin\AppData\Local\Temp\BE07.tmp"83⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\BE84.tmp"C:\Users\Admin\AppData\Local\Temp\BE84.tmp"84⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\BF10.tmp"C:\Users\Admin\AppData\Local\Temp\BF10.tmp"85⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"86⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\C029.tmp"C:\Users\Admin\AppData\Local\Temp\C029.tmp"87⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"88⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\C123.tmp"C:\Users\Admin\AppData\Local\Temp\C123.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"90⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\C23D.tmp"C:\Users\Admin\AppData\Local\Temp\C23D.tmp"91⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"92⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\C327.tmp"C:\Users\Admin\AppData\Local\Temp\C327.tmp"93⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\C394.tmp"C:\Users\Admin\AppData\Local\Temp\C394.tmp"94⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\C402.tmp"C:\Users\Admin\AppData\Local\Temp\C402.tmp"95⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\C46F.tmp"C:\Users\Admin\AppData\Local\Temp\C46F.tmp"96⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\C50B.tmp"C:\Users\Admin\AppData\Local\Temp\C50B.tmp"97⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\C588.tmp"C:\Users\Admin\AppData\Local\Temp\C588.tmp"98⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\C634.tmp"C:\Users\Admin\AppData\Local\Temp\C634.tmp"99⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"100⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\C74E.tmp"C:\Users\Admin\AppData\Local\Temp\C74E.tmp"101⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\C7BB.tmp"C:\Users\Admin\AppData\Local\Temp\C7BB.tmp"102⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\C848.tmp"C:\Users\Admin\AppData\Local\Temp\C848.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"104⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\C951.tmp"C:\Users\Admin\AppData\Local\Temp\C951.tmp"105⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"106⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"107⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"108⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\CB36.tmp"C:\Users\Admin\AppData\Local\Temp\CB36.tmp"109⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"110⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\CC3F.tmp"C:\Users\Admin\AppData\Local\Temp\CC3F.tmp"111⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"112⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\CD68.tmp"C:\Users\Admin\AppData\Local\Temp\CD68.tmp"113⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"114⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\CEC0.tmp"C:\Users\Admin\AppData\Local\Temp\CEC0.tmp"115⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"116⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"117⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\D066.tmp"C:\Users\Admin\AppData\Local\Temp\D066.tmp"118⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"119⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\D160.tmp"C:\Users\Admin\AppData\Local\Temp\D160.tmp"120⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"121⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\D24A.tmp"C:\Users\Admin\AppData\Local\Temp\D24A.tmp"122⤵PID:5796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-