Analysis
- max time kernel
120s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 13:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-16_0124264dfbf5c013b172744231b92640_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_0124264dfbf5c013b172744231b92640_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-16_0124264dfbf5c013b172744231b92640_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260716-qf6tfaas2s
- SHA256 8517b9f8c3833feda2bd1b5e2dc7d065faacd6e8dbdb483398baf025e45b4de1
- MD5 0124264dfbf5c013b172744231b92640
- SHA1 7b73ee91f9d01039f972c6ca41e8d3c89c9e09dd
- SHA512 be6aa7646745f402870fbf0cd3763bae0d187408ecaed6347c39e846c5d550e271a3d085f7e2842b63cdf2907d6b889ee39ed06cba2ee1517ebb194608e25d99
- SSDEEP 12288:wU5rCOTeiDliUlHBb8w3DVJGvmFOcJKV0GqQ1NZ+3/v+I9hUG2VA:wUQOJD0UZBQw3j80GqQ1NGEA
- TLSH T1D9E4E12173D88632E5FB037859B5E7554D7EBD26AB22D6CF2F8016AE0971BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1960 891C.tmp 4764 8A25.tmp 4380 8BDB.tmp 3248 8D42.tmp 3844 8E2D.tmp 2288 8EB9.tmp 936 8F36.tmp 3688 90BD.tmp 5320 91B7.tmp 5180 9282.tmp 2460 93CA.tmp 3556 94A5.tmp 3488 9580.tmp 2600 966A.tmp 2160 9754.tmp 980 983F.tmp 4792 9987.tmp 5396 9AA0.tmp 3772 9C17.tmp 4900 9D5F.tmp 1716 9EA7.tmp 3888 9FC1.tmp 4624 A0DA.tmp 1112 A1F3.tmp 5072 A2DD.tmp 6028 A406.tmp 4720 A510.tmp 4932 A5FA.tmp 3716 A733.tmp 4956 A80E.tmp 2856 A8F8.tmp 2312 A9E2.tmp 5748 AACD.tmp 680 ABB7.tmp 3368 AC92.tmp 3636 AD2E.tmp 4864 ADBB.tmp 3628 AE86.tmp 4520 AF8F.tmp 4288 B05B.tmp 4552 B126.tmp 4376 B1F1.tmp 1300 B2BC.tmp 200 B368.tmp 3908 B404.tmp 424 B4A0.tmp 5280 B52D.tmp 4692 B608.tmp 5496 B6B4.tmp 5452 B721.tmp 772 B79E.tmp 3036 B81B.tmp 4224 B898.tmp 3344 B905.tmp 1556 B9A2.tmp 4216 BA3E.tmp 4572 BACA.tmp 4880 BB67.tmp 1616 BBE4.tmp 4268 BC61.tmp 5960 BCED.tmp 2088 BD6A.tmp 4192 BE07.tmp 2020 BE84.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B40F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E38B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 352B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B641.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2920.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 831C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F756.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1251.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2883.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F38E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5881.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C95C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 1960 2808 2026-07-16_0124264dfbf5c013b172744231b92640_elex_mafia_stealc_tofsee.exe 87 PID 1960 wrote to memory of 4764 1960 891C.tmp 88 PID 4764 wrote to memory of 4380 4764 8A25.tmp 89 PID 4380 wrote to memory of 3248 4380 8BDB.tmp 90 PID 3248 wrote to memory of 3844 3248 8D42.tmp 91 PID 3844 wrote to memory of 2288 3844 8E2D.tmp 92 PID 2288 wrote to memory of 936 2288 8EB9.tmp 93 PID 936 wrote to memory of 3688 936 8F36.tmp 94 PID 3688 wrote to memory of 5320 3688 90BD.tmp 95 PID 5320 wrote to memory of 5180 5320 91B7.tmp 96 PID 5180 wrote to memory of 2460 5180 9282.tmp 97 PID 2460 wrote to memory of 3556 2460 93CA.tmp 98 PID 3556 wrote to memory of 3488 3556 94A5.tmp 99 PID 3488 wrote to memory of 2600 3488 9580.tmp 100 PID 2600 wrote to memory of 2160 2600 966A.tmp 101 PID 2160 wrote to memory of 980 2160 9754.tmp 102 PID 980 wrote to memory of 4792 980 983F.tmp 103 PID 4792 wrote to memory of 5396 4792 9987.tmp 104 PID 5396 wrote to memory of 3772 5396 9AA0.tmp 105 PID 3772 wrote to memory of 4900 3772 9C17.tmp 106 PID 4900 wrote to memory of 1716 4900 9D5F.tmp 107 PID 1716 wrote to memory of 3888 1716 9EA7.tmp 108 PID 3888 wrote to memory of 4624 3888 9FC1.tmp 109 PID 4624 wrote to memory of 1112 4624 A0DA.tmp 110 PID 1112 wrote to memory of 5072 1112 A1F3.tmp 111 PID 5072 wrote to memory of 6028 5072 A2DD.tmp 112 PID 6028 wrote to memory of 4720 6028 A406.tmp 113 PID 4720 wrote to memory of 4932 4720 A510.tmp 114 PID 4932 wrote to memory of 3716 4932 A5FA.tmp 115 PID 3716 wrote to memory of 4956 3716 A733.tmp 116 PID 4956 wrote to memory of 2856 4956 A80E.tmp 117 PID 2856 wrote to memory of 2312 2856 A8F8.tmp 118 PID 2312 wrote to memory of 5748 2312 A9E2.tmp 119 PID 5748 wrote to memory of 680 5748 AACD.tmp 120 PID 680 wrote to memory of 3368 680 ABB7.tmp 121 PID 3368 wrote to memory of 3636 3368 AC92.tmp 122 PID 3636 wrote to memory of 4864 3636 AD2E.tmp 123 PID 4864 wrote to memory of 3628 4864 ADBB.tmp 124 PID 3628 wrote to memory of 4520 3628 AE86.tmp 125 PID 4520 wrote to memory of 4288 4520 AF8F.tmp 126 PID 4288 wrote to memory of 4552 4288 B05B.tmp 127 PID 4552 wrote to memory of 4376 4552 B126.tmp 128 PID 4376 wrote to memory of 1300 4376 B1F1.tmp 129 PID 1300 wrote to memory of 200 1300 B2BC.tmp 130 PID 200 wrote to memory of 3908 200 B368.tmp 131 PID 3908 wrote to memory of 424 3908 B404.tmp 132 PID 424 wrote to memory of 5280 424 B4A0.tmp 133 PID 5280 wrote to memory of 4692 5280 B52D.tmp 134 PID 4692 wrote to memory of 5496 4692 B608.tmp 135 PID 5496 wrote to memory of 5452 5496 B6B4.tmp 136 PID 5452 wrote to memory of 772 5452 B721.tmp 137 PID 772 wrote to memory of 3036 772 B79E.tmp 138 PID 3036 wrote to memory of 4224 3036 B81B.tmp 139 PID 4224 wrote to memory of 3344 4224 B898.tmp 140 PID 3344 wrote to memory of 1556 3344 B905.tmp 141 PID 1556 wrote to memory of 4216 1556 B9A2.tmp 142 PID 4216 wrote to memory of 4572 4216 BA3E.tmp 143 PID 4572 wrote to memory of 4880 4572 BACA.tmp 144 PID 4880 wrote to memory of 1616 4880 BB67.tmp 145 PID 1616 wrote to memory of 4268 1616 BBE4.tmp 146 PID 4268 wrote to memory of 5960 4268 BC61.tmp 147 PID 5960 wrote to memory of 2088 5960 BCED.tmp 148 PID 2088 wrote to memory of 4192 2088 BD6A.tmp 149 PID 4192 wrote to memory of 2020 4192 BE07.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_0124264dfbf5c013b172744231b92640_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_0124264dfbf5c013b172744231b92640_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\891C.tmp"C:\Users\Admin\AppData\Local\Temp\891C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\8A25.tmp"C:\Users\Admin\AppData\Local\Temp\8A25.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\8F36.tmp"C:\Users\Admin\AppData\Local\Temp\8F36.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\90BD.tmp"C:\Users\Admin\AppData\Local\Temp\90BD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\91B7.tmp"C:\Users\Admin\AppData\Local\Temp\91B7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\9282.tmp"C:\Users\Admin\AppData\Local\Temp\9282.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\93CA.tmp"C:\Users\Admin\AppData\Local\Temp\93CA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\94A5.tmp"C:\Users\Admin\AppData\Local\Temp\94A5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\9580.tmp"C:\Users\Admin\AppData\Local\Temp\9580.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\966A.tmp"C:\Users\Admin\AppData\Local\Temp\966A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\9754.tmp"C:\Users\Admin\AppData\Local\Temp\9754.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\983F.tmp"C:\Users\Admin\AppData\Local\Temp\983F.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\9987.tmp"C:\Users\Admin\AppData\Local\Temp\9987.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\9C17.tmp"C:\Users\Admin\AppData\Local\Temp\9C17.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\9D5F.tmp"C:\Users\Admin\AppData\Local\Temp\9D5F.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\A406.tmp"C:\Users\Admin\AppData\Local\Temp\A406.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\A510.tmp"C:\Users\Admin\AppData\Local\Temp\A510.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\A733.tmp"C:\Users\Admin\AppData\Local\Temp\A733.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\A80E.tmp"C:\Users\Admin\AppData\Local\Temp\A80E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\AACD.tmp"C:\Users\Admin\AppData\Local\Temp\AACD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\AC92.tmp"C:\Users\Admin\AppData\Local\Temp\AC92.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\AE86.tmp"C:\Users\Admin\AppData\Local\Temp\AE86.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\B368.tmp"C:\Users\Admin\AppData\Local\Temp\B368.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\B404.tmp"C:\Users\Admin\AppData\Local\Temp\B404.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\B52D.tmp"C:\Users\Admin\AppData\Local\Temp\B52D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\B608.tmp"C:\Users\Admin\AppData\Local\Temp\B608.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\B721.tmp"C:\Users\Admin\AppData\Local\Temp\B721.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\B79E.tmp"C:\Users\Admin\AppData\Local\Temp\B79E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\B81B.tmp"C:\Users\Admin\AppData\Local\Temp\B81B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\B898.tmp"C:\Users\Admin\AppData\Local\Temp\B898.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\B905.tmp"C:\Users\Admin\AppData\Local\Temp\B905.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\BACA.tmp"C:\Users\Admin\AppData\Local\Temp\BACA.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\BB67.tmp"C:\Users\Admin\AppData\Local\Temp\BB67.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\BBE4.tmp"C:\Users\Admin\AppData\Local\Temp\BBE4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\BC61.tmp"C:\Users\Admin\AppData\Local\Temp\BC61.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\BCED.tmp"C:\Users\Admin\AppData\Local\Temp\BCED.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\BE07.tmp"C:\Users\Admin\AppData\Local\Temp\BE07.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\BE84.tmp"C:\Users\Admin\AppData\Local\Temp\BE84.tmp"65⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\BF01.tmp"C:\Users\Admin\AppData\Local\Temp\BF01.tmp"66⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"67⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"68⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\C087.tmp"C:\Users\Admin\AppData\Local\Temp\C087.tmp"69⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\C104.tmp"C:\Users\Admin\AppData\Local\Temp\C104.tmp"70⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"71⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"72⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"73⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\C356.tmp"C:\Users\Admin\AppData\Local\Temp\C356.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"75⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\C440.tmp"C:\Users\Admin\AppData\Local\Temp\C440.tmp"76⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\C4BD.tmp"C:\Users\Admin\AppData\Local\Temp\C4BD.tmp"77⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\C54A.tmp"C:\Users\Admin\AppData\Local\Temp\C54A.tmp"78⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\C5E6.tmp"C:\Users\Admin\AppData\Local\Temp\C5E6.tmp"79⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\C663.tmp"C:\Users\Admin\AppData\Local\Temp\C663.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"81⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\C75D.tmp"C:\Users\Admin\AppData\Local\Temp\C75D.tmp"82⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"83⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\C876.tmp"C:\Users\Admin\AppData\Local\Temp\C876.tmp"84⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\C8F3.tmp"C:\Users\Admin\AppData\Local\Temp\C8F3.tmp"85⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\C970.tmp"C:\Users\Admin\AppData\Local\Temp\C970.tmp"86⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"87⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"88⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\CB26.tmp"C:\Users\Admin\AppData\Local\Temp\CB26.tmp"89⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"90⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\CC30.tmp"C:\Users\Admin\AppData\Local\Temp\CC30.tmp"91⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\CCBC.tmp"C:\Users\Admin\AppData\Local\Temp\CCBC.tmp"92⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\CD49.tmp"C:\Users\Admin\AppData\Local\Temp\CD49.tmp"93⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"94⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\CE33.tmp"C:\Users\Admin\AppData\Local\Temp\CE33.tmp"95⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"96⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"97⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"98⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\D027.tmp"C:\Users\Admin\AppData\Local\Temp\D027.tmp"99⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\D095.tmp"C:\Users\Admin\AppData\Local\Temp\D095.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\D121.tmp"C:\Users\Admin\AppData\Local\Temp\D121.tmp"101⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"102⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\D22B.tmp"C:\Users\Admin\AppData\Local\Temp\D22B.tmp"103⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\D298.tmp"C:\Users\Admin\AppData\Local\Temp\D298.tmp"104⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\D334.tmp"C:\Users\Admin\AppData\Local\Temp\D334.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"106⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\D45D.tmp"C:\Users\Admin\AppData\Local\Temp\D45D.tmp"107⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"108⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\D596.tmp"C:\Users\Admin\AppData\Local\Temp\D596.tmp"109⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\D613.tmp"C:\Users\Admin\AppData\Local\Temp\D613.tmp"110⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\D690.tmp"C:\Users\Admin\AppData\Local\Temp\D690.tmp"111⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"112⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\D799.tmp"C:\Users\Admin\AppData\Local\Temp\D799.tmp"113⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"114⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"115⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"116⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"117⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"118⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"119⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\DB43.tmp"C:\Users\Admin\AppData\Local\Temp\DB43.tmp"120⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"122⤵PID:2952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-