Analysis
- max time kernel
120s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 02:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_ab0db2d84aa9404e1b529f397bbc4798_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_ab0db2d84aa9404e1b529f397bbc4798_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-17_ab0db2d84aa9404e1b529f397bbc4798_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260718-c2rprag16y
- SHA256 f376dd2cd4f39378c5db5b81f0eb2183279efe7fa3311402f5a6734fc687b2d5
- MD5 ab0db2d84aa9404e1b529f397bbc4798
- SHA1 4a2d5c3179672de9efd3c9ef3bab1bf414d4cc79
- SHA512 8c6787efb884eeb2b5a224325a71406b705cf8ac1c984ff4fff2de7d164b93f2fb17aa0fc89013b9265f0b64ecfc538f137c2bdb5c4d0ff0ff3ef137734e629b
- SSDEEP 12288:NU5rCOTeij3j0dFb3P+gAUWh7gWaVDEVJTZwlH:NUQOJjwd5fWUq70STSlH
- TLSH T176B4F1257684C032E5D202310EE6EBB26A3A7C75532694C73B98677E2FB52E1D379307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2328 78B1.tmp 2456 794D.tmp 4580 7A56.tmp 5016 7B12.tmp 4056 7C3B.tmp 4320 7CE7.tmp 1948 7D73.tmp 3396 7E10.tmp 3380 7EBB.tmp 6116 7F87.tmp 400 7FF4.tmp 4536 8081.tmp 5936 813C.tmp 1796 81D8.tmp 2308 8255.tmp 6120 82F2.tmp 784 83EC.tmp 5952 84A7.tmp 3248 8524.tmp 1592 85B1.tmp 3032 866C.tmp 5624 86F9.tmp 3284 87C4.tmp 6024 8860.tmp 824 891C.tmp 4616 89E7.tmp 4732 8A73.tmp 4212 8AF0.tmp 2588 8B8D.tmp 1580 8C29.tmp 1300 8CE4.tmp 4164 8D81.tmp 996 8E0D.tmp 3472 8E7B.tmp 4132 8F07.tmp 4752 8F84.tmp 1732 8FF2.tmp 1500 905F.tmp 3268 90EC.tmp 1576 9169.tmp 1040 91F5.tmp 1276 9263.tmp 3216 92FF.tmp 2208 937C.tmp 3764 93E9.tmp 2416 9457.tmp 5284 94B4.tmp 2940 9531.tmp 5492 95AE.tmp 5832 963B.tmp 4248 96B8.tmp 2748 9716.tmp 3016 9793.tmp 5012 981F.tmp 4324 98AC.tmp 5208 9919.tmp 2936 9996.tmp 1200 9A04.tmp 3224 9A90.tmp 2508 9B3C.tmp 848 9BB9.tmp 4308 9C46.tmp 2060 9CA4.tmp 596 9D21.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F93B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B06A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1425.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4727.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C24C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 663D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F41A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8723.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 320E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F667.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D841.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F761.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A56E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D99D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7456.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C71F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C01A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 146F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD4.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5732 wrote to memory of 2328 5732 2026-07-17_ab0db2d84aa9404e1b529f397bbc4798_elex_mafia_stealc_tofsee.exe 89 PID 2328 wrote to memory of 2456 2328 78B1.tmp 90 PID 2456 wrote to memory of 4580 2456 794D.tmp 91 PID 4580 wrote to memory of 5016 4580 7A56.tmp 92 PID 5016 wrote to memory of 4056 5016 7B12.tmp 93 PID 4056 wrote to memory of 4320 4056 7C3B.tmp 94 PID 4320 wrote to memory of 1948 4320 7CE7.tmp 95 PID 1948 wrote to memory of 3396 1948 7D73.tmp 96 PID 3396 wrote to memory of 3380 3396 7E10.tmp 97 PID 3380 wrote to memory of 6116 3380 7EBB.tmp 98 PID 6116 wrote to memory of 400 6116 7F87.tmp 99 PID 400 wrote to memory of 4536 400 7FF4.tmp 100 PID 4536 wrote to memory of 5936 4536 8081.tmp 101 PID 5936 wrote to memory of 1796 5936 813C.tmp 102 PID 1796 wrote to memory of 2308 1796 81D8.tmp 103 PID 2308 wrote to memory of 6120 2308 8255.tmp 104 PID 6120 wrote to memory of 784 6120 82F2.tmp 105 PID 784 wrote to memory of 5952 784 83EC.tmp 106 PID 5952 wrote to memory of 3248 5952 84A7.tmp 107 PID 3248 wrote to memory of 1592 3248 8524.tmp 108 PID 1592 wrote to memory of 3032 1592 85B1.tmp 109 PID 3032 wrote to memory of 5624 3032 866C.tmp 110 PID 5624 wrote to memory of 3284 5624 86F9.tmp 111 PID 3284 wrote to memory of 6024 3284 87C4.tmp 112 PID 6024 wrote to memory of 824 6024 8860.tmp 113 PID 824 wrote to memory of 4616 824 891C.tmp 114 PID 4616 wrote to memory of 4732 4616 89E7.tmp 115 PID 4732 wrote to memory of 4212 4732 8A73.tmp 116 PID 4212 wrote to memory of 2588 4212 8AF0.tmp 117 PID 2588 wrote to memory of 1580 2588 8B8D.tmp 118 PID 1580 wrote to memory of 1300 1580 8C29.tmp 119 PID 1300 wrote to memory of 4164 1300 8CE4.tmp 120 PID 4164 wrote to memory of 996 4164 8D81.tmp 121 PID 996 wrote to memory of 3472 996 8E0D.tmp 122 PID 3472 wrote to memory of 4132 3472 8E7B.tmp 123 PID 4132 wrote to memory of 4752 4132 8F07.tmp 124 PID 4752 wrote to memory of 1732 4752 8F84.tmp 125 PID 1732 wrote to memory of 1500 1732 8FF2.tmp 126 PID 1500 wrote to memory of 3268 1500 905F.tmp 127 PID 3268 wrote to memory of 1576 3268 90EC.tmp 128 PID 1576 wrote to memory of 1040 1576 9169.tmp 129 PID 1040 wrote to memory of 1276 1040 91F5.tmp 130 PID 1276 wrote to memory of 3216 1276 9263.tmp 131 PID 3216 wrote to memory of 2208 3216 92FF.tmp 132 PID 2208 wrote to memory of 3764 2208 937C.tmp 133 PID 3764 wrote to memory of 2416 3764 93E9.tmp 134 PID 2416 wrote to memory of 5284 2416 9457.tmp 135 PID 5284 wrote to memory of 2940 5284 94B4.tmp 136 PID 2940 wrote to memory of 5492 2940 9531.tmp 137 PID 5492 wrote to memory of 5832 5492 95AE.tmp 138 PID 5832 wrote to memory of 4248 5832 963B.tmp 139 PID 4248 wrote to memory of 2748 4248 96B8.tmp 140 PID 2748 wrote to memory of 3016 2748 9716.tmp 141 PID 3016 wrote to memory of 5012 3016 9793.tmp 142 PID 5012 wrote to memory of 4324 5012 981F.tmp 143 PID 4324 wrote to memory of 5208 4324 98AC.tmp 144 PID 5208 wrote to memory of 2936 5208 9919.tmp 145 PID 2936 wrote to memory of 1200 2936 9996.tmp 146 PID 1200 wrote to memory of 3224 1200 9A04.tmp 147 PID 3224 wrote to memory of 2508 3224 9A90.tmp 148 PID 2508 wrote to memory of 848 2508 9B3C.tmp 149 PID 848 wrote to memory of 4308 848 9BB9.tmp 150 PID 4308 wrote to memory of 2060 4308 9C46.tmp 151 PID 2060 wrote to memory of 596 2060 9CA4.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ab0db2d84aa9404e1b529f397bbc4798_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_ab0db2d84aa9404e1b529f397bbc4798_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\78B1.tmp"C:\Users\Admin\AppData\Local\Temp\78B1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\794D.tmp"C:\Users\Admin\AppData\Local\Temp\794D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\7A56.tmp"C:\Users\Admin\AppData\Local\Temp\7A56.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\7B12.tmp"C:\Users\Admin\AppData\Local\Temp\7B12.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\7D73.tmp"C:\Users\Admin\AppData\Local\Temp\7D73.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\7E10.tmp"C:\Users\Admin\AppData\Local\Temp\7E10.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\7EBB.tmp"C:\Users\Admin\AppData\Local\Temp\7EBB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\7F87.tmp"C:\Users\Admin\AppData\Local\Temp\7F87.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\8081.tmp"C:\Users\Admin\AppData\Local\Temp\8081.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\813C.tmp"C:\Users\Admin\AppData\Local\Temp\813C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\81D8.tmp"C:\Users\Admin\AppData\Local\Temp\81D8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\8255.tmp"C:\Users\Admin\AppData\Local\Temp\8255.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\82F2.tmp"C:\Users\Admin\AppData\Local\Temp\82F2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\84A7.tmp"C:\Users\Admin\AppData\Local\Temp\84A7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\8524.tmp"C:\Users\Admin\AppData\Local\Temp\8524.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\866C.tmp"C:\Users\Admin\AppData\Local\Temp\866C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\87C4.tmp"C:\Users\Admin\AppData\Local\Temp\87C4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\8860.tmp"C:\Users\Admin\AppData\Local\Temp\8860.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\891C.tmp"C:\Users\Admin\AppData\Local\Temp\891C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\8D81.tmp"C:\Users\Admin\AppData\Local\Temp\8D81.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\8F07.tmp"C:\Users\Admin\AppData\Local\Temp\8F07.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\8F84.tmp"C:\Users\Admin\AppData\Local\Temp\8F84.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\8FF2.tmp"C:\Users\Admin\AppData\Local\Temp\8FF2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\905F.tmp"C:\Users\Admin\AppData\Local\Temp\905F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\90EC.tmp"C:\Users\Admin\AppData\Local\Temp\90EC.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\9169.tmp"C:\Users\Admin\AppData\Local\Temp\9169.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\91F5.tmp"C:\Users\Admin\AppData\Local\Temp\91F5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\9263.tmp"C:\Users\Admin\AppData\Local\Temp\9263.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\92FF.tmp"C:\Users\Admin\AppData\Local\Temp\92FF.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\937C.tmp"C:\Users\Admin\AppData\Local\Temp\937C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\93E9.tmp"C:\Users\Admin\AppData\Local\Temp\93E9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\9457.tmp"C:\Users\Admin\AppData\Local\Temp\9457.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\94B4.tmp"C:\Users\Admin\AppData\Local\Temp\94B4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\9531.tmp"C:\Users\Admin\AppData\Local\Temp\9531.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\95AE.tmp"C:\Users\Admin\AppData\Local\Temp\95AE.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\963B.tmp"C:\Users\Admin\AppData\Local\Temp\963B.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\96B8.tmp"C:\Users\Admin\AppData\Local\Temp\96B8.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\9716.tmp"C:\Users\Admin\AppData\Local\Temp\9716.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\981F.tmp"C:\Users\Admin\AppData\Local\Temp\981F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\98AC.tmp"C:\Users\Admin\AppData\Local\Temp\98AC.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\9919.tmp"C:\Users\Admin\AppData\Local\Temp\9919.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\9996.tmp"C:\Users\Admin\AppData\Local\Temp\9996.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9A04.tmp"C:\Users\Admin\AppData\Local\Temp\9A04.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\9A90.tmp"C:\Users\Admin\AppData\Local\Temp\9A90.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\9C46.tmp"C:\Users\Admin\AppData\Local\Temp\9C46.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\9D21.tmp"C:\Users\Admin\AppData\Local\Temp\9D21.tmp"65⤵
- Executes dropped EXE
PID:596 -
C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"66⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"67⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\9E88.tmp"C:\Users\Admin\AppData\Local\Temp\9E88.tmp"68⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"69⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\9F63.tmp"C:\Users\Admin\AppData\Local\Temp\9F63.tmp"70⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"71⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\A03E.tmp"C:\Users\Admin\AppData\Local\Temp\A03E.tmp"72⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"73⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\A118.tmp"C:\Users\Admin\AppData\Local\Temp\A118.tmp"74⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\A195.tmp"C:\Users\Admin\AppData\Local\Temp\A195.tmp"75⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\A232.tmp"C:\Users\Admin\AppData\Local\Temp\A232.tmp"76⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\A29F.tmp"C:\Users\Admin\AppData\Local\Temp\A29F.tmp"77⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\A31C.tmp"C:\Users\Admin\AppData\Local\Temp\A31C.tmp"78⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\A399.tmp"C:\Users\Admin\AppData\Local\Temp\A399.tmp"79⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\A406.tmp"C:\Users\Admin\AppData\Local\Temp\A406.tmp"80⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\A483.tmp"C:\Users\Admin\AppData\Local\Temp\A483.tmp"81⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\A500.tmp"C:\Users\Admin\AppData\Local\Temp\A500.tmp"82⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\A56E.tmp"C:\Users\Admin\AppData\Local\Temp\A56E.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:616 -
C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"84⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"86⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\A762.tmp"C:\Users\Admin\AppData\Local\Temp\A762.tmp"87⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"88⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\A908.tmp"C:\Users\Admin\AppData\Local\Temp\A908.tmp"89⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\A975.tmp"C:\Users\Admin\AppData\Local\Temp\A975.tmp"90⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\AA11.tmp"C:\Users\Admin\AppData\Local\Temp\AA11.tmp"91⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\AA9E.tmp"C:\Users\Admin\AppData\Local\Temp\AA9E.tmp"92⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\AB2A.tmp"C:\Users\Admin\AppData\Local\Temp\AB2A.tmp"93⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\AB98.tmp"C:\Users\Admin\AppData\Local\Temp\AB98.tmp"94⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"95⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\AC53.tmp"C:\Users\Admin\AppData\Local\Temp\AC53.tmp"96⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"97⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"98⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"99⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\AE18.tmp"C:\Users\Admin\AppData\Local\Temp\AE18.tmp"100⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"101⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\AF12.tmp"C:\Users\Admin\AppData\Local\Temp\AF12.tmp"102⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"103⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\B00C.tmp"C:\Users\Admin\AppData\Local\Temp\B00C.tmp"104⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\B06A.tmp"C:\Users\Admin\AppData\Local\Temp\B06A.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"106⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"107⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"108⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"109⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"110⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"111⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"112⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\B433.tmp"C:\Users\Admin\AppData\Local\Temp\B433.tmp"113⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B4B0.tmp"C:\Users\Admin\AppData\Local\Temp\B4B0.tmp"114⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\B52D.tmp"C:\Users\Admin\AppData\Local\Temp\B52D.tmp"115⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\B59A.tmp"C:\Users\Admin\AppData\Local\Temp\B59A.tmp"116⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\B608.tmp"C:\Users\Admin\AppData\Local\Temp\B608.tmp"117⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\B685.tmp"C:\Users\Admin\AppData\Local\Temp\B685.tmp"118⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"119⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\B76F.tmp"C:\Users\Admin\AppData\Local\Temp\B76F.tmp"120⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\B7EC.tmp"C:\Users\Admin\AppData\Local\Temp\B7EC.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\B859.tmp"C:\Users\Admin\AppData\Local\Temp\B859.tmp"122⤵PID:5296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-