Analysis
- max time kernel
127s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 14:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_04229737eec381bd1d90ca63073680de_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_04229737eec381bd1d90ca63073680de_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-12_04229737eec381bd1d90ca63073680de_elex_mafia_stealc_tofsee.exe
- Size 541KB
- Sample260712-r3nrtady7x
- SHA256 0e7a6510fe488a3604c15642dd064cb44da79f7e49ab3901cac64507d9d6c162
- MD5 04229737eec381bd1d90ca63073680de
- SHA1 d38f2b54fd6f5f414b71921d4ad04207ed55d9e0
- SHA512 9e081a5b2a7eaf7c9ee93608f6c277e43ef88b0cf91f1cc82b749f17d4fea3895abd0626f8a1be4e555e4bdea6d4eddd80c8293f62ae1595261f2c3f53a45700
- SSDEEP 12288:HU5rCOTeiJFtL4tUxmtR+B3WJtN3ZxhNZb73ctO:HUQOJJFl42ARa6N3ZfNV73ctO
- TLSH T1BDC4F126B545C232D68202721EEADBE22E3FBC75532594C32794A22D2FB67E0D375347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6296 9C94.tmp 6760 9DAD.tmp 4524 9EC7.tmp 1796 A02E.tmp 3224 A0BB.tmp 4136 A138.tmp 4660 A1A5.tmp 2104 A260.tmp 3200 A2DD.tmp 1428 A36A.tmp 5884 A3F7.tmp 2408 A493.tmp 5064 A52F.tmp 6436 A5AC.tmp 4520 A668.tmp 3576 A714.tmp 712 A7B0.tmp 5308 A85C.tmp 4156 A8E8.tmp 6416 A9A4.tmp 2760 AA30.tmp 2656 AACD.tmp 5668 AB59.tmp 3288 ABE6.tmp 4720 AC73.tmp 4772 AD4D.tmp 1288 ADF9.tmp 3956 AEC4.tmp 7160 AF61.tmp 1016 B00C.tmp 4332 B0F7.tmp 6428 B174.tmp 560 B23F.tmp 3188 B2EB.tmp 5676 B387.tmp 3064 B423.tmp 1700 B4A0.tmp 6328 B51D.tmp 1648 B59A.tmp 2740 B627.tmp 5588 B694.tmp 5764 B721.tmp 5388 B7BD.tmp 3484 B83A.tmp 4628 B8B7.tmp 7112 B934.tmp 7096 B9C1.tmp 7128 BA5D.tmp 4812 BADA.tmp 6348 BB76.tmp 6632 BC03.tmp 3384 BC9F.tmp 6668 BD2C.tmp 4428 BD99.tmp 5376 BE35.tmp 5780 BEE1.tmp 600 BF7E.tmp 3744 C00A.tmp 3060 C087.tmp 3756 C0F5.tmp 3012 C172.tmp 2056 C1EF.tmp 892 C27B.tmp 6020 C317.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7655.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B23F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 906A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B83A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 449C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 712A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 469B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 601E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F62E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A36A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 558F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AFB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 6296 4372 2026-07-12_04229737eec381bd1d90ca63073680de_elex_mafia_stealc_tofsee.exe 88 PID 6296 wrote to memory of 6760 6296 9C94.tmp 89 PID 6760 wrote to memory of 4524 6760 9DAD.tmp 90 PID 4524 wrote to memory of 1796 4524 9EC7.tmp 91 PID 1796 wrote to memory of 3224 1796 A02E.tmp 92 PID 3224 wrote to memory of 4136 3224 A0BB.tmp 93 PID 4136 wrote to memory of 4660 4136 A138.tmp 94 PID 4660 wrote to memory of 2104 4660 A1A5.tmp 95 PID 2104 wrote to memory of 3200 2104 A260.tmp 96 PID 3200 wrote to memory of 1428 3200 A2DD.tmp 97 PID 1428 wrote to memory of 5884 1428 A36A.tmp 98 PID 5884 wrote to memory of 2408 5884 A3F7.tmp 99 PID 2408 wrote to memory of 5064 2408 A493.tmp 100 PID 5064 wrote to memory of 6436 5064 A52F.tmp 101 PID 6436 wrote to memory of 4520 6436 A5AC.tmp 102 PID 4520 wrote to memory of 3576 4520 A668.tmp 103 PID 3576 wrote to memory of 712 3576 A714.tmp 104 PID 712 wrote to memory of 5308 712 A7B0.tmp 105 PID 5308 wrote to memory of 4156 5308 A85C.tmp 106 PID 4156 wrote to memory of 6416 4156 A8E8.tmp 107 PID 6416 wrote to memory of 2760 6416 A9A4.tmp 108 PID 2760 wrote to memory of 2656 2760 AA30.tmp 109 PID 2656 wrote to memory of 5668 2656 AACD.tmp 110 PID 5668 wrote to memory of 3288 5668 AB59.tmp 111 PID 3288 wrote to memory of 4720 3288 ABE6.tmp 112 PID 4720 wrote to memory of 4772 4720 AC73.tmp 113 PID 4772 wrote to memory of 1288 4772 AD4D.tmp 114 PID 1288 wrote to memory of 3956 1288 ADF9.tmp 115 PID 3956 wrote to memory of 7160 3956 AEC4.tmp 116 PID 7160 wrote to memory of 1016 7160 AF61.tmp 117 PID 1016 wrote to memory of 4332 1016 B00C.tmp 118 PID 4332 wrote to memory of 6428 4332 B0F7.tmp 119 PID 6428 wrote to memory of 560 6428 B174.tmp 120 PID 560 wrote to memory of 3188 560 B23F.tmp 121 PID 3188 wrote to memory of 5676 3188 B2EB.tmp 122 PID 5676 wrote to memory of 3064 5676 B387.tmp 123 PID 3064 wrote to memory of 1700 3064 B423.tmp 124 PID 1700 wrote to memory of 6328 1700 B4A0.tmp 125 PID 6328 wrote to memory of 1648 6328 B51D.tmp 126 PID 1648 wrote to memory of 2740 1648 B59A.tmp 127 PID 2740 wrote to memory of 5588 2740 B627.tmp 128 PID 5588 wrote to memory of 5764 5588 B694.tmp 129 PID 5764 wrote to memory of 5388 5764 B721.tmp 130 PID 5388 wrote to memory of 3484 5388 B7BD.tmp 131 PID 3484 wrote to memory of 4628 3484 B83A.tmp 132 PID 4628 wrote to memory of 7112 4628 B8B7.tmp 133 PID 7112 wrote to memory of 7096 7112 B934.tmp 134 PID 7096 wrote to memory of 7128 7096 B9C1.tmp 135 PID 7128 wrote to memory of 4812 7128 BA5D.tmp 136 PID 4812 wrote to memory of 6348 4812 BADA.tmp 137 PID 6348 wrote to memory of 6632 6348 BB76.tmp 138 PID 6632 wrote to memory of 3384 6632 BC03.tmp 139 PID 3384 wrote to memory of 6668 3384 BC9F.tmp 140 PID 6668 wrote to memory of 4428 6668 BD2C.tmp 141 PID 4428 wrote to memory of 5376 4428 BD99.tmp 142 PID 5376 wrote to memory of 5780 5376 BE35.tmp 143 PID 5780 wrote to memory of 600 5780 BEE1.tmp 144 PID 600 wrote to memory of 3744 600 BF7E.tmp 145 PID 3744 wrote to memory of 3060 3744 C00A.tmp 146 PID 3060 wrote to memory of 3756 3060 C087.tmp 147 PID 3756 wrote to memory of 3012 3756 C0F5.tmp 148 PID 3012 wrote to memory of 2056 3012 C172.tmp 149 PID 2056 wrote to memory of 892 2056 C1EF.tmp 150 PID 892 wrote to memory of 6020 892 C27B.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_04229737eec381bd1d90ca63073680de_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_04229737eec381bd1d90ca63073680de_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\9C94.tmp"C:\Users\Admin\AppData\Local\Temp\9C94.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6296 -
C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6760 -
C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\A02E.tmp"C:\Users\Admin\AppData\Local\Temp\A02E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\A138.tmp"C:\Users\Admin\AppData\Local\Temp\A138.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\A1A5.tmp"C:\Users\Admin\AppData\Local\Temp\A1A5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\A260.tmp"C:\Users\Admin\AppData\Local\Temp\A260.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\A36A.tmp"C:\Users\Admin\AppData\Local\Temp\A36A.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\A493.tmp"C:\Users\Admin\AppData\Local\Temp\A493.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\A52F.tmp"C:\Users\Admin\AppData\Local\Temp\A52F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6436 -
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\A714.tmp"C:\Users\Admin\AppData\Local\Temp\A714.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\A85C.tmp"C:\Users\Admin\AppData\Local\Temp\A85C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6416 -
C:\Users\Admin\AppData\Local\Temp\AA30.tmp"C:\Users\Admin\AppData\Local\Temp\AA30.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\AACD.tmp"C:\Users\Admin\AppData\Local\Temp\AACD.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\AB59.tmp"C:\Users\Admin\AppData\Local\Temp\AB59.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\AC73.tmp"C:\Users\Admin\AppData\Local\Temp\AC73.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\AF61.tmp"C:\Users\Admin\AppData\Local\Temp\AF61.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7160 -
C:\Users\Admin\AppData\Local\Temp\B00C.tmp"C:\Users\Admin\AppData\Local\Temp\B00C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6428 -
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\B51D.tmp"C:\Users\Admin\AppData\Local\Temp\B51D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6328 -
C:\Users\Admin\AppData\Local\Temp\B59A.tmp"C:\Users\Admin\AppData\Local\Temp\B59A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\B627.tmp"C:\Users\Admin\AppData\Local\Temp\B627.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\B694.tmp"C:\Users\Admin\AppData\Local\Temp\B694.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\B721.tmp"C:\Users\Admin\AppData\Local\Temp\B721.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\B83A.tmp"C:\Users\Admin\AppData\Local\Temp\B83A.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\B8B7.tmp"C:\Users\Admin\AppData\Local\Temp\B8B7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\B934.tmp"C:\Users\Admin\AppData\Local\Temp\B934.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7112 -
C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7096 -
C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7128 -
C:\Users\Admin\AppData\Local\Temp\BADA.tmp"C:\Users\Admin\AppData\Local\Temp\BADA.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\BB76.tmp"C:\Users\Admin\AppData\Local\Temp\BB76.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6348 -
C:\Users\Admin\AppData\Local\Temp\BC03.tmp"C:\Users\Admin\AppData\Local\Temp\BC03.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6632 -
C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\BD2C.tmp"C:\Users\Admin\AppData\Local\Temp\BD2C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6668 -
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\BE35.tmp"C:\Users\Admin\AppData\Local\Temp\BE35.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\C00A.tmp"C:\Users\Admin\AppData\Local\Temp\C00A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\C087.tmp"C:\Users\Admin\AppData\Local\Temp\C087.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\C172.tmp"C:\Users\Admin\AppData\Local\Temp\C172.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\C1EF.tmp"C:\Users\Admin\AppData\Local\Temp\C1EF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\C27B.tmp"C:\Users\Admin\AppData\Local\Temp\C27B.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\C317.tmp"C:\Users\Admin\AppData\Local\Temp\C317.tmp"65⤵
- Executes dropped EXE
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\C375.tmp"C:\Users\Admin\AppData\Local\Temp\C375.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:6952 -
C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"67⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\C46F.tmp"C:\Users\Admin\AppData\Local\Temp\C46F.tmp"68⤵PID:6796
-
C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"69⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\C569.tmp"C:\Users\Admin\AppData\Local\Temp\C569.tmp"70⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\C5E6.tmp"C:\Users\Admin\AppData\Local\Temp\C5E6.tmp"71⤵PID:6576
-
C:\Users\Admin\AppData\Local\Temp\C663.tmp"C:\Users\Admin\AppData\Local\Temp\C663.tmp"72⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"73⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\C75D.tmp"C:\Users\Admin\AppData\Local\Temp\C75D.tmp"74⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"75⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\C876.tmp"C:\Users\Admin\AppData\Local\Temp\C876.tmp"76⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"77⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\C961.tmp"C:\Users\Admin\AppData\Local\Temp\C961.tmp"78⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"79⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"80⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"81⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\CB84.tmp"C:\Users\Admin\AppData\Local\Temp\CB84.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\CC30.tmp"C:\Users\Admin\AppData\Local\Temp\CC30.tmp"83⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\CCDB.tmp"C:\Users\Admin\AppData\Local\Temp\CCDB.tmp"84⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\CD78.tmp"C:\Users\Admin\AppData\Local\Temp\CD78.tmp"85⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"86⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\CE91.tmp"C:\Users\Admin\AppData\Local\Temp\CE91.tmp"87⤵PID:6840
-
C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"88⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"89⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\D095.tmp"C:\Users\Admin\AppData\Local\Temp\D095.tmp"91⤵PID:6580
-
C:\Users\Admin\AppData\Local\Temp\D112.tmp"C:\Users\Admin\AppData\Local\Temp\D112.tmp"92⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"93⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\D24A.tmp"C:\Users\Admin\AppData\Local\Temp\D24A.tmp"94⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\D2C7.tmp"C:\Users\Admin\AppData\Local\Temp\D2C7.tmp"95⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\D373.tmp"C:\Users\Admin\AppData\Local\Temp\D373.tmp"96⤵PID:6620
-
C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"97⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\D45D.tmp"C:\Users\Admin\AppData\Local\Temp\D45D.tmp"98⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"99⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\D577.tmp"C:\Users\Admin\AppData\Local\Temp\D577.tmp"100⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"101⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\D671.tmp"C:\Users\Admin\AppData\Local\Temp\D671.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"103⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\D77A.tmp"C:\Users\Admin\AppData\Local\Temp\D77A.tmp"104⤵PID:7076
-
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"105⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"106⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"107⤵PID:6732
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"108⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"109⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\DA97.tmp"C:\Users\Admin\AppData\Local\Temp\DA97.tmp"110⤵PID:6224
-
C:\Users\Admin\AppData\Local\Temp\DB14.tmp"C:\Users\Admin\AppData\Local\Temp\DB14.tmp"111⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"112⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\DC5C.tmp"C:\Users\Admin\AppData\Local\Temp\DC5C.tmp"113⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\DCD9.tmp"C:\Users\Admin\AppData\Local\Temp\DCD9.tmp"114⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\DD47.tmp"C:\Users\Admin\AppData\Local\Temp\DD47.tmp"115⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\DDC4.tmp"C:\Users\Admin\AppData\Local\Temp\DDC4.tmp"116⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\DE41.tmp"C:\Users\Admin\AppData\Local\Temp\DE41.tmp"117⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"118⤵PID:6608
-
C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"119⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"120⤵PID:6464
-
C:\Users\Admin\AppData\Local\Temp\E054.tmp"C:\Users\Admin\AppData\Local\Temp\E054.tmp"121⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"122⤵PID:4848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-