Analysis
- max time kernel
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_b2cadfeaba9c52a79d85e6c9592b4b76_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_b2cadfeaba9c52a79d85e6c9592b4b76_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-15_b2cadfeaba9c52a79d85e6c9592b4b76_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260715-e15akaet8x
- SHA256 ef30e7779eb93434c8979fba5ba11cb47e16c10491e94fd0988d5c7823499055
- MD5 b2cadfeaba9c52a79d85e6c9592b4b76
- SHA1 8197e2e747b408cd62e388e25b4f74bbc85c7e1c
- SHA512 b4b23190dee7b2b0e0887462f82fd7fb6fddf58c1a8b54d20c9152e5ef5643364fce6ee44f460322af9318ae809d83e71b36425122f889fe5d5f3a7e07c014b1
- SSDEEP 12288:HU5rCOTeiJx650GOzhnJDZhuk/R8I7FANWseRIQcNZ:HUQOJJYiGOtJek58YHseRIQcN
- TLSH T170B4F121B581C032E59302344AE5EBB2293FBD714726A4C33B84776E6FB53E2A675347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1092 ADEA.tmp 4760 AEE4.tmp 5184 AF9F.tmp 2912 B01C.tmp 3364 B0A9.tmp 3000 B135.tmp 1964 B1F1.tmp 4560 B27D.tmp 5088 B329.tmp 4596 B3B6.tmp 1292 B452.tmp 3720 B53D.tmp 1060 B5E8.tmp 1516 B646.tmp 5808 B6F2.tmp 3140 B75F.tmp 4416 B7FC.tmp 4992 B888.tmp 5336 B905.tmp 3412 B982.tmp 2740 BA4D.tmp 4352 BADA.tmp 2044 BB47.tmp 1000 BC03.tmp 3656 BC9F.tmp 6032 BD5B.tmp 1172 BDF7.tmp 5556 BE93.tmp 972 BF2F.tmp 2640 C00A.tmp 4876 C097.tmp 4688 C123.tmp 5220 C1A0.tmp 2708 C20E.tmp 6020 C27B.tmp 4820 C2E9.tmp 5532 C366.tmp 6036 C3E3.tmp 2676 C450.tmp 5456 C4BD.tmp 5916 C54A.tmp 4180 C5A8.tmp 4748 C605.tmp 4272 C673.tmp 2092 C6F0.tmp 4132 C76D.tmp 5924 C7DA.tmp 4400 C857.tmp 1704 C8B5.tmp 5176 C932.tmp 248 C9BF.tmp 4340 CA3C.tmp 5012 CAC8.tmp 5092 CB16.tmp 5252 CB93.tmp 2316 CC30.tmp 848 CCAD.tmp 5616 CD0A.tmp 3112 CD97.tmp 2656 CE04.tmp 4408 CE81.tmp 5376 CEEF.tmp 5824 CF6C.tmp 1372 CFF8.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4070.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 393D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B816.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 687A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 753C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3143.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D11C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 136A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4622.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D969.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A77C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B01C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6488.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E996.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A22D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE4E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4292 wrote to memory of 1092 4292 2026-07-15_b2cadfeaba9c52a79d85e6c9592b4b76_elex_mafia_stealc_tofsee.exe 87 PID 1092 wrote to memory of 4760 1092 ADEA.tmp 88 PID 4760 wrote to memory of 5184 4760 AEE4.tmp 89 PID 5184 wrote to memory of 2912 5184 AF9F.tmp 90 PID 2912 wrote to memory of 3364 2912 B01C.tmp 91 PID 3364 wrote to memory of 3000 3364 B0A9.tmp 92 PID 3000 wrote to memory of 1964 3000 B135.tmp 93 PID 1964 wrote to memory of 4560 1964 B1F1.tmp 94 PID 4560 wrote to memory of 5088 4560 B27D.tmp 95 PID 5088 wrote to memory of 4596 5088 B329.tmp 96 PID 4596 wrote to memory of 1292 4596 B3B6.tmp 97 PID 1292 wrote to memory of 3720 1292 B452.tmp 98 PID 3720 wrote to memory of 1060 3720 B53D.tmp 99 PID 1060 wrote to memory of 1516 1060 B5E8.tmp 100 PID 1516 wrote to memory of 5808 1516 B646.tmp 101 PID 5808 wrote to memory of 3140 5808 B6F2.tmp 102 PID 3140 wrote to memory of 4416 3140 B75F.tmp 103 PID 4416 wrote to memory of 4992 4416 B7FC.tmp 104 PID 4992 wrote to memory of 5336 4992 B888.tmp 105 PID 5336 wrote to memory of 3412 5336 B905.tmp 106 PID 3412 wrote to memory of 2740 3412 B982.tmp 107 PID 2740 wrote to memory of 4352 2740 BA4D.tmp 108 PID 4352 wrote to memory of 2044 4352 BADA.tmp 109 PID 2044 wrote to memory of 1000 2044 BB47.tmp 110 PID 1000 wrote to memory of 3656 1000 BC03.tmp 111 PID 3656 wrote to memory of 6032 3656 BC9F.tmp 112 PID 6032 wrote to memory of 1172 6032 BD5B.tmp 113 PID 1172 wrote to memory of 5556 1172 BDF7.tmp 114 PID 5556 wrote to memory of 972 5556 BE93.tmp 115 PID 972 wrote to memory of 2640 972 BF2F.tmp 116 PID 2640 wrote to memory of 4876 2640 C00A.tmp 117 PID 4876 wrote to memory of 4688 4876 C097.tmp 118 PID 4688 wrote to memory of 5220 4688 C123.tmp 119 PID 5220 wrote to memory of 2708 5220 C1A0.tmp 120 PID 2708 wrote to memory of 6020 2708 C20E.tmp 121 PID 6020 wrote to memory of 4820 6020 C27B.tmp 122 PID 4820 wrote to memory of 5532 4820 C2E9.tmp 123 PID 5532 wrote to memory of 6036 5532 C366.tmp 124 PID 6036 wrote to memory of 2676 6036 C3E3.tmp 125 PID 2676 wrote to memory of 5456 2676 C450.tmp 126 PID 5456 wrote to memory of 5916 5456 C4BD.tmp 127 PID 5916 wrote to memory of 4180 5916 C54A.tmp 128 PID 4180 wrote to memory of 4748 4180 C5A8.tmp 129 PID 4748 wrote to memory of 4272 4748 C605.tmp 130 PID 4272 wrote to memory of 2092 4272 C673.tmp 131 PID 2092 wrote to memory of 4132 2092 C6F0.tmp 132 PID 4132 wrote to memory of 5924 4132 C76D.tmp 133 PID 5924 wrote to memory of 4400 5924 C7DA.tmp 134 PID 4400 wrote to memory of 1704 4400 C857.tmp 135 PID 1704 wrote to memory of 5176 1704 C8B5.tmp 136 PID 5176 wrote to memory of 248 5176 C932.tmp 137 PID 248 wrote to memory of 4340 248 C9BF.tmp 138 PID 4340 wrote to memory of 5012 4340 CA3C.tmp 139 PID 5012 wrote to memory of 5092 5012 CAC8.tmp 140 PID 5092 wrote to memory of 5252 5092 CB16.tmp 141 PID 5252 wrote to memory of 2316 5252 CB93.tmp 142 PID 2316 wrote to memory of 848 2316 CC30.tmp 143 PID 848 wrote to memory of 5616 848 CCAD.tmp 144 PID 5616 wrote to memory of 3112 5616 CD0A.tmp 145 PID 3112 wrote to memory of 2656 3112 CD97.tmp 146 PID 2656 wrote to memory of 4408 2656 CE04.tmp 147 PID 4408 wrote to memory of 5376 4408 CE81.tmp 148 PID 5376 wrote to memory of 5824 5376 CEEF.tmp 149 PID 5824 wrote to memory of 1372 5824 CF6C.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_b2cadfeaba9c52a79d85e6c9592b4b76_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_b2cadfeaba9c52a79d85e6c9592b4b76_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\ADEA.tmp"C:\Users\Admin\AppData\Local\Temp\ADEA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\AEE4.tmp"C:\Users\Admin\AppData\Local\Temp\AEE4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\B01C.tmp"C:\Users\Admin\AppData\Local\Temp\B01C.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\B135.tmp"C:\Users\Admin\AppData\Local\Temp\B135.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\B452.tmp"C:\Users\Admin\AppData\Local\Temp\B452.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\B53D.tmp"C:\Users\Admin\AppData\Local\Temp\B53D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\B646.tmp"C:\Users\Admin\AppData\Local\Temp\B646.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\B75F.tmp"C:\Users\Admin\AppData\Local\Temp\B75F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\B888.tmp"C:\Users\Admin\AppData\Local\Temp\B888.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\B905.tmp"C:\Users\Admin\AppData\Local\Temp\B905.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\B982.tmp"C:\Users\Admin\AppData\Local\Temp\B982.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\BADA.tmp"C:\Users\Admin\AppData\Local\Temp\BADA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\BB47.tmp"C:\Users\Admin\AppData\Local\Temp\BB47.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\BC03.tmp"C:\Users\Admin\AppData\Local\Temp\BC03.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\BE93.tmp"C:\Users\Admin\AppData\Local\Temp\BE93.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\C00A.tmp"C:\Users\Admin\AppData\Local\Temp\C00A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\C097.tmp"C:\Users\Admin\AppData\Local\Temp\C097.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\C123.tmp"C:\Users\Admin\AppData\Local\Temp\C123.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\C20E.tmp"C:\Users\Admin\AppData\Local\Temp\C20E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\C27B.tmp"C:\Users\Admin\AppData\Local\Temp\C27B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\C366.tmp"C:\Users\Admin\AppData\Local\Temp\C366.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\C450.tmp"C:\Users\Admin\AppData\Local\Temp\C450.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\C4BD.tmp"C:\Users\Admin\AppData\Local\Temp\C4BD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\C54A.tmp"C:\Users\Admin\AppData\Local\Temp\C54A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\C605.tmp"C:\Users\Admin\AppData\Local\Temp\C605.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\C673.tmp"C:\Users\Admin\AppData\Local\Temp\C673.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\C76D.tmp"C:\Users\Admin\AppData\Local\Temp\C76D.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\C857.tmp"C:\Users\Admin\AppData\Local\Temp\C857.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\C932.tmp"C:\Users\Admin\AppData\Local\Temp\C932.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\CB16.tmp"C:\Users\Admin\AppData\Local\Temp\CB16.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\CB93.tmp"C:\Users\Admin\AppData\Local\Temp\CB93.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\CC30.tmp"C:\Users\Admin\AppData\Local\Temp\CC30.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\CCAD.tmp"C:\Users\Admin\AppData\Local\Temp\CCAD.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\CD97.tmp"C:\Users\Admin\AppData\Local\Temp\CD97.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\CE04.tmp"C:\Users\Admin\AppData\Local\Temp\CE04.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\CE81.tmp"C:\Users\Admin\AppData\Local\Temp\CE81.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"65⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\D066.tmp"C:\Users\Admin\AppData\Local\Temp\D066.tmp"66⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"67⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\D140.tmp"C:\Users\Admin\AppData\Local\Temp\D140.tmp"68⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"69⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\D25A.tmp"C:\Users\Admin\AppData\Local\Temp\D25A.tmp"70⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"71⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\D344.tmp"C:\Users\Admin\AppData\Local\Temp\D344.tmp"72⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"73⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\D42E.tmp"C:\Users\Admin\AppData\Local\Temp\D42E.tmp"74⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\D49C.tmp"C:\Users\Admin\AppData\Local\Temp\D49C.tmp"75⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\D509.tmp"C:\Users\Admin\AppData\Local\Temp\D509.tmp"76⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\D577.tmp"C:\Users\Admin\AppData\Local\Temp\D577.tmp"77⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"78⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\D661.tmp"C:\Users\Admin\AppData\Local\Temp\D661.tmp"79⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\D6DE.tmp"C:\Users\Admin\AppData\Local\Temp\D6DE.tmp"80⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"81⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"82⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"83⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"84⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"85⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"86⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\DA59.tmp"C:\Users\Admin\AppData\Local\Temp\DA59.tmp"87⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"88⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\DB33.tmp"C:\Users\Admin\AppData\Local\Temp\DB33.tmp"89⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"91⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"92⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\DD18.tmp"C:\Users\Admin\AppData\Local\Temp\DD18.tmp"93⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\DD85.tmp"C:\Users\Admin\AppData\Local\Temp\DD85.tmp"94⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"95⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\DE50.tmp"C:\Users\Admin\AppData\Local\Temp\DE50.tmp"96⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"97⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"98⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"99⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\E044.tmp"C:\Users\Admin\AppData\Local\Temp\E044.tmp"100⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"101⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\E11F.tmp"C:\Users\Admin\AppData\Local\Temp\E11F.tmp"102⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\E18C.tmp"C:\Users\Admin\AppData\Local\Temp\E18C.tmp"103⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\E209.tmp"C:\Users\Admin\AppData\Local\Temp\E209.tmp"104⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\E296.tmp"C:\Users\Admin\AppData\Local\Temp\E296.tmp"105⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\E313.tmp"C:\Users\Admin\AppData\Local\Temp\E313.tmp"106⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\E380.tmp"C:\Users\Admin\AppData\Local\Temp\E380.tmp"107⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"108⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\E46B.tmp"C:\Users\Admin\AppData\Local\Temp\E46B.tmp"109⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"110⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\E555.tmp"C:\Users\Admin\AppData\Local\Temp\E555.tmp"111⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"112⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\E63F.tmp"C:\Users\Admin\AppData\Local\Temp\E63F.tmp"113⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\E6BC.tmp"C:\Users\Admin\AppData\Local\Temp\E6BC.tmp"114⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\E72A.tmp"C:\Users\Admin\AppData\Local\Temp\E72A.tmp"115⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\E797.tmp"C:\Users\Admin\AppData\Local\Temp\E797.tmp"116⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\E805.tmp"C:\Users\Admin\AppData\Local\Temp\E805.tmp"117⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\E872.tmp"C:\Users\Admin\AppData\Local\Temp\E872.tmp"118⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"119⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\E94D.tmp"C:\Users\Admin\AppData\Local\Temp\E94D.tmp"120⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"121⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\EA56.tmp"C:\Users\Admin\AppData\Local\Temp\EA56.tmp"122⤵PID:3912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-