Analysis
- max time kernel
104s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_b949272f5add6ec233cd1ec97e10f4af_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_b949272f5add6ec233cd1ec97e10f4af_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-14_b949272f5add6ec233cd1ec97e10f4af_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260714-txfv5abs2s
- SHA256 83b2ca6f9c1568478028eae519425de6a2368ecb65407d70b806bbb9d023b1cd
- MD5 b949272f5add6ec233cd1ec97e10f4af
- SHA1 250f242164f8316cb7e3c2eeb8e210503dd13a90
- SHA512 0d99c55edb2ac7dc5586e23a535eda72d2193821e361aa160e612c78ad1137a13b64597af62e13e849bde25524da1b9bd9a5734f64a61e4a1784e9d004a9dcc2
- SSDEEP 12288:NU5rCOTeijhtSjJ7WoWRu3IXgKvlvTTZwlH:NUQOJjejJxEOIXv1TSlH
- TLSH T1A5B4E025B544C032E5C212710BE6EBB1AA3BBD344326A4C73794A67E2FB57E1E374346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3280 13E.tmp 4160 229.tmp 2388 304.tmp 1504 3DE.tmp 2860 4A9.tmp 4552 575.tmp 4104 630.tmp 1220 6EC.tmp 4920 7C6.tmp 4680 8C0.tmp 1640 94D.tmp 4708 A08.tmp 4288 AF3.tmp 5728 BCE.tmp 1112 C79.tmp 2968 D06.tmp 4632 DC2.tmp 3140 E5E.tmp 6048 F29.tmp 4480 FC5.tmp 4928 10A0.tmp 2628 119A.tmp 2564 1265.tmp 4272 134F.tmp 404 13EC.tmp 3160 14D6.tmp 1480 15B1.tmp 5692 167C.tmp 1684 1709.tmp 1232 17E3.tmp 2052 188F.tmp 3696 192B.tmp 1948 19C8.tmp 5388 1A54.tmp 2836 1B00.tmp 2384 1B7D.tmp 3440 1BFA.tmp 1648 1C96.tmp 2484 1D23.tmp 4772 1DBF.tmp 2760 1E5C.tmp 3020 1EE8.tmp 1472 1F84.tmp 4600 2011.tmp 5864 208E.tmp 2712 211B.tmp 1028 21B7.tmp 3876 2253.tmp 4568 22EF.tmp 2436 237C.tmp 928 2447.tmp 3664 24F3.tmp 2692 2580.tmp 4268 262C.tmp 5800 26B8.tmp 2540 2783.tmp 5832 2800.tmp 5928 289D.tmp 4152 2929.tmp 4544 29C5.tmp 764 2A52.tmp 4472 2ADF.tmp 2752 2B7B.tmp 2032 2BF8.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 277F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5385.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 327B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 425A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 663D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 502A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 890C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B28D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C990.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E46B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B03B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A03E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 289D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A426.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 451D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3937.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E8A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6028 wrote to memory of 3280 6028 2026-07-14_b949272f5add6ec233cd1ec97e10f4af_elex_mafia_stealc_tofsee.exe 88 PID 3280 wrote to memory of 4160 3280 13E.tmp 89 PID 4160 wrote to memory of 2388 4160 229.tmp 90 PID 2388 wrote to memory of 1504 2388 304.tmp 91 PID 1504 wrote to memory of 2860 1504 3DE.tmp 92 PID 2860 wrote to memory of 4552 2860 4A9.tmp 93 PID 4552 wrote to memory of 4104 4552 575.tmp 94 PID 4104 wrote to memory of 1220 4104 630.tmp 95 PID 1220 wrote to memory of 4920 1220 6EC.tmp 96 PID 4920 wrote to memory of 4680 4920 7C6.tmp 97 PID 4680 wrote to memory of 1640 4680 8C0.tmp 98 PID 1640 wrote to memory of 4708 1640 94D.tmp 99 PID 4708 wrote to memory of 4288 4708 A08.tmp 100 PID 4288 wrote to memory of 5728 4288 AF3.tmp 101 PID 5728 wrote to memory of 1112 5728 BCE.tmp 102 PID 1112 wrote to memory of 2968 1112 C79.tmp 103 PID 2968 wrote to memory of 4632 2968 D06.tmp 104 PID 4632 wrote to memory of 3140 4632 DC2.tmp 105 PID 3140 wrote to memory of 6048 3140 E5E.tmp 106 PID 6048 wrote to memory of 4480 6048 F29.tmp 107 PID 4480 wrote to memory of 4928 4480 FC5.tmp 108 PID 4928 wrote to memory of 2628 4928 10A0.tmp 109 PID 2628 wrote to memory of 2564 2628 119A.tmp 110 PID 2564 wrote to memory of 4272 2564 1265.tmp 111 PID 4272 wrote to memory of 404 4272 134F.tmp 112 PID 404 wrote to memory of 3160 404 13EC.tmp 113 PID 3160 wrote to memory of 1480 3160 14D6.tmp 114 PID 1480 wrote to memory of 5692 1480 15B1.tmp 115 PID 5692 wrote to memory of 1684 5692 167C.tmp 116 PID 1684 wrote to memory of 1232 1684 1709.tmp 117 PID 1232 wrote to memory of 2052 1232 17E3.tmp 118 PID 2052 wrote to memory of 3696 2052 188F.tmp 119 PID 3696 wrote to memory of 1948 3696 192B.tmp 120 PID 1948 wrote to memory of 5388 1948 19C8.tmp 121 PID 5388 wrote to memory of 2836 5388 1A54.tmp 122 PID 2836 wrote to memory of 2384 2836 1B00.tmp 123 PID 2384 wrote to memory of 3440 2384 1B7D.tmp 124 PID 3440 wrote to memory of 1648 3440 1BFA.tmp 125 PID 1648 wrote to memory of 2484 1648 1C96.tmp 126 PID 2484 wrote to memory of 4772 2484 1D23.tmp 127 PID 4772 wrote to memory of 2760 4772 1DBF.tmp 128 PID 2760 wrote to memory of 3020 2760 1E5C.tmp 129 PID 3020 wrote to memory of 1472 3020 1EE8.tmp 130 PID 1472 wrote to memory of 4600 1472 1F84.tmp 131 PID 4600 wrote to memory of 5864 4600 2011.tmp 132 PID 5864 wrote to memory of 2712 5864 208E.tmp 133 PID 2712 wrote to memory of 1028 2712 211B.tmp 134 PID 1028 wrote to memory of 3876 1028 21B7.tmp 135 PID 3876 wrote to memory of 4568 3876 2253.tmp 136 PID 4568 wrote to memory of 2436 4568 22EF.tmp 137 PID 2436 wrote to memory of 928 2436 237C.tmp 138 PID 928 wrote to memory of 3664 928 2447.tmp 139 PID 3664 wrote to memory of 2692 3664 24F3.tmp 140 PID 2692 wrote to memory of 4268 2692 2580.tmp 141 PID 4268 wrote to memory of 5800 4268 262C.tmp 142 PID 5800 wrote to memory of 2540 5800 26B8.tmp 143 PID 2540 wrote to memory of 5832 2540 2783.tmp 144 PID 5832 wrote to memory of 5928 5832 2800.tmp 145 PID 5928 wrote to memory of 4152 5928 289D.tmp 146 PID 4152 wrote to memory of 4544 4152 2929.tmp 147 PID 4544 wrote to memory of 764 4544 29C5.tmp 148 PID 764 wrote to memory of 4472 764 2A52.tmp 149 PID 4472 wrote to memory of 2752 4472 2ADF.tmp 150 PID 2752 wrote to memory of 2032 2752 2B7B.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_b949272f5add6ec233cd1ec97e10f4af_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_b949272f5add6ec233cd1ec97e10f4af_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\13E.tmp"C:\Users\Admin\AppData\Local\Temp\13E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\229.tmp"C:\Users\Admin\AppData\Local\Temp\229.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\304.tmp"C:\Users\Admin\AppData\Local\Temp\304.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\3DE.tmp"C:\Users\Admin\AppData\Local\Temp\3DE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\4A9.tmp"C:\Users\Admin\AppData\Local\Temp\4A9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\575.tmp"C:\Users\Admin\AppData\Local\Temp\575.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\6EC.tmp"C:\Users\Admin\AppData\Local\Temp\6EC.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\7C6.tmp"C:\Users\Admin\AppData\Local\Temp\7C6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\8C0.tmp"C:\Users\Admin\AppData\Local\Temp\8C0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\94D.tmp"C:\Users\Admin\AppData\Local\Temp\94D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\A08.tmp"C:\Users\Admin\AppData\Local\Temp\A08.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\AF3.tmp"C:\Users\Admin\AppData\Local\Temp\AF3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\BCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\C79.tmp"C:\Users\Admin\AppData\Local\Temp\C79.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\D06.tmp"C:\Users\Admin\AppData\Local\Temp\D06.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\DC2.tmp"C:\Users\Admin\AppData\Local\Temp\DC2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\E5E.tmp"C:\Users\Admin\AppData\Local\Temp\E5E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\F29.tmp"C:\Users\Admin\AppData\Local\Temp\F29.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\FC5.tmp"C:\Users\Admin\AppData\Local\Temp\FC5.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\10A0.tmp"C:\Users\Admin\AppData\Local\Temp\10A0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\119A.tmp"C:\Users\Admin\AppData\Local\Temp\119A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\1265.tmp"C:\Users\Admin\AppData\Local\Temp\1265.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\134F.tmp"C:\Users\Admin\AppData\Local\Temp\134F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\13EC.tmp"C:\Users\Admin\AppData\Local\Temp\13EC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\14D6.tmp"C:\Users\Admin\AppData\Local\Temp\14D6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\15B1.tmp"C:\Users\Admin\AppData\Local\Temp\15B1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\167C.tmp"C:\Users\Admin\AppData\Local\Temp\167C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\1709.tmp"C:\Users\Admin\AppData\Local\Temp\1709.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\17E3.tmp"C:\Users\Admin\AppData\Local\Temp\17E3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\188F.tmp"C:\Users\Admin\AppData\Local\Temp\188F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\192B.tmp"C:\Users\Admin\AppData\Local\Temp\192B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\1BFA.tmp"C:\Users\Admin\AppData\Local\Temp\1BFA.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\1C96.tmp"C:\Users\Admin\AppData\Local\Temp\1C96.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1D23.tmp"C:\Users\Admin\AppData\Local\Temp\1D23.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\1E5C.tmp"C:\Users\Admin\AppData\Local\Temp\1E5C.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\1F84.tmp"C:\Users\Admin\AppData\Local\Temp\1F84.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\2011.tmp"C:\Users\Admin\AppData\Local\Temp\2011.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\208E.tmp"C:\Users\Admin\AppData\Local\Temp\208E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\211B.tmp"C:\Users\Admin\AppData\Local\Temp\211B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\21B7.tmp"C:\Users\Admin\AppData\Local\Temp\21B7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\2253.tmp"C:\Users\Admin\AppData\Local\Temp\2253.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\22EF.tmp"C:\Users\Admin\AppData\Local\Temp\22EF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\237C.tmp"C:\Users\Admin\AppData\Local\Temp\237C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\2447.tmp"C:\Users\Admin\AppData\Local\Temp\2447.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\24F3.tmp"C:\Users\Admin\AppData\Local\Temp\24F3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\2580.tmp"C:\Users\Admin\AppData\Local\Temp\2580.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\262C.tmp"C:\Users\Admin\AppData\Local\Temp\262C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\26B8.tmp"C:\Users\Admin\AppData\Local\Temp\26B8.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\2783.tmp"C:\Users\Admin\AppData\Local\Temp\2783.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\2800.tmp"C:\Users\Admin\AppData\Local\Temp\2800.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\289D.tmp"C:\Users\Admin\AppData\Local\Temp\289D.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\2929.tmp"C:\Users\Admin\AppData\Local\Temp\2929.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\29C5.tmp"C:\Users\Admin\AppData\Local\Temp\29C5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\2A52.tmp"C:\Users\Admin\AppData\Local\Temp\2A52.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"65⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\2C65.tmp"C:\Users\Admin\AppData\Local\Temp\2C65.tmp"66⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"67⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"68⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"69⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\2F73.tmp"C:\Users\Admin\AppData\Local\Temp\2F73.tmp"71⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"72⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\307C.tmp"C:\Users\Admin\AppData\Local\Temp\307C.tmp"73⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\3138.tmp"C:\Users\Admin\AppData\Local\Temp\3138.tmp"74⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\31E4.tmp"C:\Users\Admin\AppData\Local\Temp\31E4.tmp"75⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"76⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\32ED.tmp"C:\Users\Admin\AppData\Local\Temp\32ED.tmp"77⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\33A9.tmp"C:\Users\Admin\AppData\Local\Temp\33A9.tmp"78⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3435.tmp"C:\Users\Admin\AppData\Local\Temp\3435.tmp"79⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\34C2.tmp"C:\Users\Admin\AppData\Local\Temp\34C2.tmp"80⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\353F.tmp"C:\Users\Admin\AppData\Local\Temp\353F.tmp"81⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\35CC.tmp"C:\Users\Admin\AppData\Local\Temp\35CC.tmp"82⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\3658.tmp"C:\Users\Admin\AppData\Local\Temp\3658.tmp"83⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\36D5.tmp"C:\Users\Admin\AppData\Local\Temp\36D5.tmp"84⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3752.tmp"C:\Users\Admin\AppData\Local\Temp\3752.tmp"85⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\37DF.tmp"C:\Users\Admin\AppData\Local\Temp\37DF.tmp"86⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\389A.tmp"C:\Users\Admin\AppData\Local\Temp\389A.tmp"87⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\3937.tmp"C:\Users\Admin\AppData\Local\Temp\3937.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\39E2.tmp"C:\Users\Admin\AppData\Local\Temp\39E2.tmp"89⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"90⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\3B88.tmp"C:\Users\Admin\AppData\Local\Temp\3B88.tmp"92⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\3C15.tmp"C:\Users\Admin\AppData\Local\Temp\3C15.tmp"93⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\3C92.tmp"C:\Users\Admin\AppData\Local\Temp\3C92.tmp"94⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"95⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"96⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\3E47.tmp"C:\Users\Admin\AppData\Local\Temp\3E47.tmp"97⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"98⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"99⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"100⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\40A9.tmp"C:\Users\Admin\AppData\Local\Temp\40A9.tmp"101⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\4126.tmp"C:\Users\Admin\AppData\Local\Temp\4126.tmp"102⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\41E1.tmp"C:\Users\Admin\AppData\Local\Temp\41E1.tmp"103⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\427E.tmp"C:\Users\Admin\AppData\Local\Temp\427E.tmp"104⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\42FB.tmp"C:\Users\Admin\AppData\Local\Temp\42FB.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\4387.tmp"C:\Users\Admin\AppData\Local\Temp\4387.tmp"106⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\4414.tmp"C:\Users\Admin\AppData\Local\Temp\4414.tmp"107⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\4491.tmp"C:\Users\Admin\AppData\Local\Temp\4491.tmp"108⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\451D.tmp"C:\Users\Admin\AppData\Local\Temp\451D.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\45C9.tmp"C:\Users\Admin\AppData\Local\Temp\45C9.tmp"110⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"111⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\4750.tmp"C:\Users\Admin\AppData\Local\Temp\4750.tmp"112⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"113⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\4879.tmp"C:\Users\Admin\AppData\Local\Temp\4879.tmp"114⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\48F6.tmp"C:\Users\Admin\AppData\Local\Temp\48F6.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\4973.tmp"C:\Users\Admin\AppData\Local\Temp\4973.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\49F0.tmp"C:\Users\Admin\AppData\Local\Temp\49F0.tmp"117⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"118⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\4B38.tmp"C:\Users\Admin\AppData\Local\Temp\4B38.tmp"119⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"120⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\4C51.tmp"C:\Users\Admin\AppData\Local\Temp\4C51.tmp"121⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\4CED.tmp"C:\Users\Admin\AppData\Local\Temp\4CED.tmp"122⤵PID:3992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-