Analysis
- max time kernel
121s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_10ec1b04b2533f0658d372a670be6929_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_10ec1b04b2533f0658d372a670be6929_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-12_10ec1b04b2533f0658d372a670be6929_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260712-rmlbrabv4n
- SHA256 2a92c40e59610d78de82ab3d1827156ce6c74253880be757832e618ddaba5c5f
- MD5 10ec1b04b2533f0658d372a670be6929
- SHA1 71d7e19f17f19e591898f76d6c1890f8e4f70ef2
- SHA512 8892fc72f07b1cca0e9d8def7f939f99379485e945dab68ef327d01a6e60d3ca230276641709541dc30093bcada66c2becae7db3fac54feab6d34df251192f6c
- SSDEEP 12288:HU5rCOTeiJR/ojVETyf3/cHrztGUD4yXNZ:HUQOJJRUi2//cHrztGUsgN
- TLSH T19BB4F120B984C032E59202314EE6EBB1693A7D719B2264C77BC4376E6FB12D2E774357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5696 F77.tmp 5612 1013.tmp 2440 10EE.tmp 1260 11AA.tmp 6052 1265.tmp 3968 134F.tmp 3252 141B.tmp 924 1488.tmp 4224 1524.tmp 4440 15C0.tmp 4116 166C.tmp 1760 16E9.tmp 3188 17A5.tmp 4600 1880.tmp 3576 190C.tmp 4268 19C8.tmp 2052 1A54.tmp 1864 1B2F.tmp 4452 1C19.tmp 2600 1CA6.tmp 4456 1D23.tmp 1848 1DBF.tmp 124 1E4C.tmp 1484 1ED9.tmp 2504 1F56.tmp 2064 2021.tmp 5384 20CD.tmp 2400 214A.tmp 3700 21E6.tmp 5932 2282.tmp 1124 234D.tmp 3580 2409.tmp 5684 2495.tmp 3684 2512.tmp 1284 258F.tmp 3884 25FD.tmp 952 2689.tmp 4248 26E7.tmp 3504 2764.tmp 4676 27D1.tmp 4376 284E.tmp 3448 28BC.tmp 2104 2958.tmp 5652 29C5.tmp 2720 2A52.tmp 3764 2ACF.tmp 416 2B4C.tmp 4292 2BB9.tmp 1600 2C46.tmp 1728 2CB3.tmp 4736 2D21.tmp 2340 2D8E.tmp 4232 2E0B.tmp 4404 2E88.tmp 5368 2F05.tmp 3240 2F92.tmp 4656 300F.tmp 4632 30AB.tmp 6020 3118.tmp 4804 3195.tmp 2092 3261.tmp 4420 32CE.tmp 5016 333B.tmp 5300 33D8.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1880.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F42A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 356E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 547A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3261.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 713E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F246.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B57B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F95A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ED9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A84C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A847.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D35F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 911B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 518C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 955C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5484 wrote to memory of 5696 5484 2026-07-12_10ec1b04b2533f0658d372a670be6929_elex_mafia_stealc_tofsee.exe 87 PID 5696 wrote to memory of 5612 5696 F77.tmp 88 PID 5612 wrote to memory of 2440 5612 1013.tmp 89 PID 2440 wrote to memory of 1260 2440 10EE.tmp 90 PID 1260 wrote to memory of 6052 1260 11AA.tmp 91 PID 6052 wrote to memory of 3968 6052 1265.tmp 92 PID 3968 wrote to memory of 3252 3968 134F.tmp 93 PID 3252 wrote to memory of 924 3252 141B.tmp 94 PID 924 wrote to memory of 4224 924 1488.tmp 95 PID 4224 wrote to memory of 4440 4224 1524.tmp 96 PID 4440 wrote to memory of 4116 4440 15C0.tmp 97 PID 4116 wrote to memory of 1760 4116 166C.tmp 98 PID 1760 wrote to memory of 3188 1760 16E9.tmp 99 PID 3188 wrote to memory of 4600 3188 17A5.tmp 100 PID 4600 wrote to memory of 3576 4600 1880.tmp 101 PID 3576 wrote to memory of 4268 3576 190C.tmp 102 PID 4268 wrote to memory of 2052 4268 19C8.tmp 103 PID 2052 wrote to memory of 1864 2052 1A54.tmp 104 PID 1864 wrote to memory of 4452 1864 1B2F.tmp 105 PID 4452 wrote to memory of 2600 4452 1C19.tmp 106 PID 2600 wrote to memory of 4456 2600 1CA6.tmp 107 PID 4456 wrote to memory of 1848 4456 1D23.tmp 108 PID 1848 wrote to memory of 124 1848 1DBF.tmp 109 PID 124 wrote to memory of 1484 124 1E4C.tmp 110 PID 1484 wrote to memory of 2504 1484 1ED9.tmp 111 PID 2504 wrote to memory of 2064 2504 1F56.tmp 112 PID 2064 wrote to memory of 5384 2064 2021.tmp 113 PID 5384 wrote to memory of 2400 5384 20CD.tmp 114 PID 2400 wrote to memory of 3700 2400 214A.tmp 115 PID 3700 wrote to memory of 5932 3700 21E6.tmp 116 PID 5932 wrote to memory of 1124 5932 2282.tmp 117 PID 1124 wrote to memory of 3580 1124 234D.tmp 118 PID 3580 wrote to memory of 5684 3580 2409.tmp 119 PID 5684 wrote to memory of 3684 5684 2495.tmp 120 PID 3684 wrote to memory of 1284 3684 2512.tmp 121 PID 1284 wrote to memory of 3884 1284 258F.tmp 122 PID 3884 wrote to memory of 952 3884 25FD.tmp 123 PID 952 wrote to memory of 4248 952 2689.tmp 124 PID 4248 wrote to memory of 3504 4248 26E7.tmp 125 PID 3504 wrote to memory of 4676 3504 2764.tmp 126 PID 4676 wrote to memory of 4376 4676 27D1.tmp 127 PID 4376 wrote to memory of 3448 4376 284E.tmp 128 PID 3448 wrote to memory of 2104 3448 28BC.tmp 129 PID 2104 wrote to memory of 5652 2104 2958.tmp 130 PID 5652 wrote to memory of 2720 5652 29C5.tmp 131 PID 2720 wrote to memory of 3764 2720 2A52.tmp 132 PID 3764 wrote to memory of 416 3764 2ACF.tmp 133 PID 416 wrote to memory of 4292 416 2B4C.tmp 134 PID 4292 wrote to memory of 1600 4292 2BB9.tmp 135 PID 1600 wrote to memory of 1728 1600 2C46.tmp 136 PID 1728 wrote to memory of 4736 1728 2CB3.tmp 137 PID 4736 wrote to memory of 2340 4736 2D21.tmp 138 PID 2340 wrote to memory of 4232 2340 2D8E.tmp 139 PID 4232 wrote to memory of 4404 4232 2E0B.tmp 140 PID 4404 wrote to memory of 5368 4404 2E88.tmp 141 PID 5368 wrote to memory of 3240 5368 2F05.tmp 142 PID 3240 wrote to memory of 4656 3240 2F92.tmp 143 PID 4656 wrote to memory of 4632 4656 300F.tmp 144 PID 4632 wrote to memory of 6020 4632 30AB.tmp 145 PID 6020 wrote to memory of 4804 6020 3118.tmp 146 PID 4804 wrote to memory of 2092 4804 3195.tmp 147 PID 2092 wrote to memory of 4420 2092 3261.tmp 148 PID 4420 wrote to memory of 5016 4420 32CE.tmp 149 PID 5016 wrote to memory of 5300 5016 333B.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_10ec1b04b2533f0658d372a670be6929_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_10ec1b04b2533f0658d372a670be6929_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\1013.tmp"C:\Users\Admin\AppData\Local\Temp\1013.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\10EE.tmp"C:\Users\Admin\AppData\Local\Temp\10EE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\11AA.tmp"C:\Users\Admin\AppData\Local\Temp\11AA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\1265.tmp"C:\Users\Admin\AppData\Local\Temp\1265.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\134F.tmp"C:\Users\Admin\AppData\Local\Temp\134F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\141B.tmp"C:\Users\Admin\AppData\Local\Temp\141B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\1488.tmp"C:\Users\Admin\AppData\Local\Temp\1488.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\1524.tmp"C:\Users\Admin\AppData\Local\Temp\1524.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\15C0.tmp"C:\Users\Admin\AppData\Local\Temp\15C0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\166C.tmp"C:\Users\Admin\AppData\Local\Temp\166C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\16E9.tmp"C:\Users\Admin\AppData\Local\Temp\16E9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\17A5.tmp"C:\Users\Admin\AppData\Local\Temp\17A5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\1C19.tmp"C:\Users\Admin\AppData\Local\Temp\1C19.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\1CA6.tmp"C:\Users\Admin\AppData\Local\Temp\1CA6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\1D23.tmp"C:\Users\Admin\AppData\Local\Temp\1D23.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\1F56.tmp"C:\Users\Admin\AppData\Local\Temp\1F56.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\214A.tmp"C:\Users\Admin\AppData\Local\Temp\214A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\21E6.tmp"C:\Users\Admin\AppData\Local\Temp\21E6.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\2282.tmp"C:\Users\Admin\AppData\Local\Temp\2282.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\234D.tmp"C:\Users\Admin\AppData\Local\Temp\234D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\2409.tmp"C:\Users\Admin\AppData\Local\Temp\2409.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\2495.tmp"C:\Users\Admin\AppData\Local\Temp\2495.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\2512.tmp"C:\Users\Admin\AppData\Local\Temp\2512.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\258F.tmp"C:\Users\Admin\AppData\Local\Temp\258F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\25FD.tmp"C:\Users\Admin\AppData\Local\Temp\25FD.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\2689.tmp"C:\Users\Admin\AppData\Local\Temp\2689.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\26E7.tmp"C:\Users\Admin\AppData\Local\Temp\26E7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\2764.tmp"C:\Users\Admin\AppData\Local\Temp\2764.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\27D1.tmp"C:\Users\Admin\AppData\Local\Temp\27D1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\284E.tmp"C:\Users\Admin\AppData\Local\Temp\284E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\28BC.tmp"C:\Users\Admin\AppData\Local\Temp\28BC.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\2958.tmp"C:\Users\Admin\AppData\Local\Temp\2958.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\29C5.tmp"C:\Users\Admin\AppData\Local\Temp\29C5.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\2A52.tmp"C:\Users\Admin\AppData\Local\Temp\2A52.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\2BB9.tmp"C:\Users\Admin\AppData\Local\Temp\2BB9.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2C46.tmp"C:\Users\Admin\AppData\Local\Temp\2C46.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\2CB3.tmp"C:\Users\Admin\AppData\Local\Temp\2CB3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\2D21.tmp"C:\Users\Admin\AppData\Local\Temp\2D21.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\2D8E.tmp"C:\Users\Admin\AppData\Local\Temp\2D8E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\2E88.tmp"C:\Users\Admin\AppData\Local\Temp\2E88.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\2F05.tmp"C:\Users\Admin\AppData\Local\Temp\2F05.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\2F92.tmp"C:\Users\Admin\AppData\Local\Temp\2F92.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\300F.tmp"C:\Users\Admin\AppData\Local\Temp\300F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\30AB.tmp"C:\Users\Admin\AppData\Local\Temp\30AB.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\3118.tmp"C:\Users\Admin\AppData\Local\Temp\3118.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\3195.tmp"C:\Users\Admin\AppData\Local\Temp\3195.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\32CE.tmp"C:\Users\Admin\AppData\Local\Temp\32CE.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\333B.tmp"C:\Users\Admin\AppData\Local\Temp\333B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\33D8.tmp"C:\Users\Admin\AppData\Local\Temp\33D8.tmp"65⤵
- Executes dropped EXE
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\3464.tmp"C:\Users\Admin\AppData\Local\Temp\3464.tmp"66⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\34F1.tmp"C:\Users\Admin\AppData\Local\Temp\34F1.tmp"67⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\356E.tmp"C:\Users\Admin\AppData\Local\Temp\356E.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\35DB.tmp"C:\Users\Admin\AppData\Local\Temp\35DB.tmp"69⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\3668.tmp"C:\Users\Admin\AppData\Local\Temp\3668.tmp"70⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\36E5.tmp"C:\Users\Admin\AppData\Local\Temp\36E5.tmp"71⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\3752.tmp"C:\Users\Admin\AppData\Local\Temp\3752.tmp"72⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"73⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\384C.tmp"C:\Users\Admin\AppData\Local\Temp\384C.tmp"74⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\38C9.tmp"C:\Users\Admin\AppData\Local\Temp\38C9.tmp"75⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\3946.tmp"C:\Users\Admin\AppData\Local\Temp\3946.tmp"76⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\39B4.tmp"C:\Users\Admin\AppData\Local\Temp\39B4.tmp"77⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\3A21.tmp"C:\Users\Admin\AppData\Local\Temp\3A21.tmp"78⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"79⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"80⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"81⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\3C34.tmp"C:\Users\Admin\AppData\Local\Temp\3C34.tmp"82⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"83⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"84⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"85⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"86⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"87⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"88⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"89⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\400D.tmp"C:\Users\Admin\AppData\Local\Temp\400D.tmp"90⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\408A.tmp"C:\Users\Admin\AppData\Local\Temp\408A.tmp"91⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\4107.tmp"C:\Users\Admin\AppData\Local\Temp\4107.tmp"92⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\4184.tmp"C:\Users\Admin\AppData\Local\Temp\4184.tmp"93⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\4220.tmp"C:\Users\Admin\AppData\Local\Temp\4220.tmp"94⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\429D.tmp"C:\Users\Admin\AppData\Local\Temp\429D.tmp"95⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\4329.tmp"C:\Users\Admin\AppData\Local\Temp\4329.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\43A6.tmp"C:\Users\Admin\AppData\Local\Temp\43A6.tmp"97⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\4433.tmp"C:\Users\Admin\AppData\Local\Temp\4433.tmp"98⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\44CF.tmp"C:\Users\Admin\AppData\Local\Temp\44CF.tmp"99⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\455C.tmp"C:\Users\Admin\AppData\Local\Temp\455C.tmp"100⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\45E9.tmp"C:\Users\Admin\AppData\Local\Temp\45E9.tmp"101⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4656.tmp"C:\Users\Admin\AppData\Local\Temp\4656.tmp"102⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\4702.tmp"C:\Users\Admin\AppData\Local\Temp\4702.tmp"103⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\477F.tmp"C:\Users\Admin\AppData\Local\Temp\477F.tmp"104⤵PID:52
-
C:\Users\Admin\AppData\Local\Temp\47EC.tmp"C:\Users\Admin\AppData\Local\Temp\47EC.tmp"105⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\4879.tmp"C:\Users\Admin\AppData\Local\Temp\4879.tmp"106⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\4905.tmp"C:\Users\Admin\AppData\Local\Temp\4905.tmp"107⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\4992.tmp"C:\Users\Admin\AppData\Local\Temp\4992.tmp"108⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\49F0.tmp"C:\Users\Admin\AppData\Local\Temp\49F0.tmp"109⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"110⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"111⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\4B67.tmp"C:\Users\Admin\AppData\Local\Temp\4B67.tmp"112⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"113⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\4C70.tmp"C:\Users\Admin\AppData\Local\Temp\4C70.tmp"114⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"115⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"116⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\4E07.tmp"C:\Users\Admin\AppData\Local\Temp\4E07.tmp"117⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\4E84.tmp"C:\Users\Admin\AppData\Local\Temp\4E84.tmp"118⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\4F20.tmp"C:\Users\Admin\AppData\Local\Temp\4F20.tmp"119⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"120⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\500A.tmp"C:\Users\Admin\AppData\Local\Temp\500A.tmp"121⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\5097.tmp"C:\Users\Admin\AppData\Local\Temp\5097.tmp"122⤵PID:1704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-