Analysis
- max time kernel
124s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 03:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_c0e86687b902292802361bc54b0be36e_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_c0e86687b902292802361bc54b0be36e_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-19_c0e86687b902292802361bc54b0be36e_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260719-dk76vads91
- SHA256 99ff58e2997d2f3fd928bcad3c7b579c61b9900eb65915461cf4272a793566cc
- MD5 c0e86687b902292802361bc54b0be36e
- SHA1 f02809e4691f934ccdeafa2610b197e27bbe7bd5
- SHA512 a69ea47aec81b026415acf0bcf1a64bfdf72452ac57704d1522891b8145f718242f2c5886aea05ff690fe6c1271f0a32e0f102fda54c96f8d9c977b6610a1b6c
- SSDEEP 12288:wU5rCOTeiDx1yZI6wDTvDnjYNZ+3/v+I9hUG2VA:wUQOJDx/DvDjYNGEA
- TLSH T1D6E4D02177D88532E5F7037859B5E6654DBEBD32A722D6CF2F8016AE09B1BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5916 EA18.tmp 3040 EAB4.tmp 5984 EB60.tmp 1396 EC98.tmp 3120 EDB2.tmp 6092 EE2F.tmp 5880 EE9C.tmp 2832 EF09.tmp 5392 F0AF.tmp 4144 F1A9.tmp 204 F294.tmp 4640 F37E.tmp 2912 F4B7.tmp 5884 F5EF.tmp 4184 F6F9.tmp 5180 F822.tmp 5172 F92B.tmp 3820 F9F6.tmp 2116 FAF0.tmp 4040 FC29.tmp 5104 FD04.tmp 1328 FDEE.tmp 3420 FEB9.tmp 5700 FFD2.tmp 824 FB.tmp 2268 1E6.tmp 1984 2E0.tmp 5892 3E9.tmp 2624 512.tmp 3800 62B.tmp 3300 735.tmp 1976 83F.tmp 2700 919.tmp 1380 9D5.tmp 5776 A71.tmp 4224 AFE.tmp 752 B9A.tmp 3308 C17.tmp 5112 CC3.tmp 4664 D40.tmp 4860 DCC.tmp 4880 E98.tmp 4024 F63.tmp 5760 101E.tmp 3964 10AB.tmp 2900 1157.tmp 2584 1231.tmp 4992 130C.tmp 856 13A8.tmp 5588 1445.tmp 5664 14E1.tmp 1928 155E.tmp 756 15DB.tmp 2400 1668.tmp 5604 16F4.tmp 5516 1781.tmp 4064 17FE.tmp 5512 188A.tmp 4344 1936.tmp 1768 19C3.tmp 3804 1A40.tmp 1360 1ADC.tmp 4452 1B69.tmp 1924 1BE6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 706A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7173.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 852A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B68B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C35C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4836.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D514.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 217F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B73B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E32D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8818.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 786D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A51B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E233.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C593.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5437.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 876C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 379C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4613.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B09F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C88.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4140 wrote to memory of 5916 4140 2026-07-19_c0e86687b902292802361bc54b0be36e_elex_mafia_stealc_tofsee.exe 88 PID 5916 wrote to memory of 3040 5916 EA18.tmp 90 PID 3040 wrote to memory of 5984 3040 EAB4.tmp 91 PID 5984 wrote to memory of 1396 5984 EB60.tmp 92 PID 1396 wrote to memory of 3120 1396 EC98.tmp 93 PID 3120 wrote to memory of 6092 3120 EDB2.tmp 94 PID 6092 wrote to memory of 5880 6092 EE2F.tmp 95 PID 5880 wrote to memory of 2832 5880 EE9C.tmp 96 PID 2832 wrote to memory of 5392 2832 EF09.tmp 97 PID 5392 wrote to memory of 4144 5392 F0AF.tmp 98 PID 4144 wrote to memory of 204 4144 F1A9.tmp 99 PID 204 wrote to memory of 4640 204 F294.tmp 100 PID 4640 wrote to memory of 2912 4640 F37E.tmp 101 PID 2912 wrote to memory of 5884 2912 F4B7.tmp 102 PID 5884 wrote to memory of 4184 5884 F5EF.tmp 103 PID 4184 wrote to memory of 5180 4184 F6F9.tmp 104 PID 5180 wrote to memory of 5172 5180 F822.tmp 105 PID 5172 wrote to memory of 3820 5172 F92B.tmp 106 PID 3820 wrote to memory of 2116 3820 F9F6.tmp 107 PID 2116 wrote to memory of 4040 2116 FAF0.tmp 108 PID 4040 wrote to memory of 5104 4040 FC29.tmp 109 PID 5104 wrote to memory of 1328 5104 FD04.tmp 110 PID 1328 wrote to memory of 3420 1328 FDEE.tmp 111 PID 3420 wrote to memory of 5700 3420 FEB9.tmp 112 PID 5700 wrote to memory of 824 5700 FFD2.tmp 113 PID 824 wrote to memory of 2268 824 FB.tmp 114 PID 2268 wrote to memory of 1984 2268 1E6.tmp 115 PID 1984 wrote to memory of 5892 1984 2E0.tmp 116 PID 5892 wrote to memory of 2624 5892 3E9.tmp 117 PID 2624 wrote to memory of 3800 2624 512.tmp 118 PID 3800 wrote to memory of 3300 3800 62B.tmp 119 PID 3300 wrote to memory of 1976 3300 735.tmp 120 PID 1976 wrote to memory of 2700 1976 83F.tmp 121 PID 2700 wrote to memory of 1380 2700 919.tmp 122 PID 1380 wrote to memory of 5776 1380 9D5.tmp 123 PID 5776 wrote to memory of 4224 5776 A71.tmp 124 PID 4224 wrote to memory of 752 4224 AFE.tmp 125 PID 752 wrote to memory of 3308 752 B9A.tmp 126 PID 3308 wrote to memory of 5112 3308 C17.tmp 127 PID 5112 wrote to memory of 4664 5112 CC3.tmp 128 PID 4664 wrote to memory of 4860 4664 D40.tmp 129 PID 4860 wrote to memory of 4880 4860 DCC.tmp 130 PID 4880 wrote to memory of 4024 4880 E98.tmp 131 PID 4024 wrote to memory of 5760 4024 F63.tmp 132 PID 5760 wrote to memory of 3964 5760 101E.tmp 133 PID 3964 wrote to memory of 2900 3964 10AB.tmp 134 PID 2900 wrote to memory of 2584 2900 1157.tmp 135 PID 2584 wrote to memory of 4992 2584 1231.tmp 136 PID 4992 wrote to memory of 856 4992 130C.tmp 137 PID 856 wrote to memory of 5588 856 13A8.tmp 138 PID 5588 wrote to memory of 5664 5588 1445.tmp 139 PID 5664 wrote to memory of 1928 5664 14E1.tmp 140 PID 1928 wrote to memory of 756 1928 155E.tmp 141 PID 756 wrote to memory of 2400 756 15DB.tmp 142 PID 2400 wrote to memory of 5604 2400 1668.tmp 143 PID 5604 wrote to memory of 5516 5604 16F4.tmp 144 PID 5516 wrote to memory of 4064 5516 1781.tmp 145 PID 4064 wrote to memory of 5512 4064 17FE.tmp 146 PID 5512 wrote to memory of 4344 5512 188A.tmp 147 PID 4344 wrote to memory of 1768 4344 1936.tmp 148 PID 1768 wrote to memory of 3804 1768 19C3.tmp 149 PID 3804 wrote to memory of 1360 3804 1A40.tmp 150 PID 1360 wrote to memory of 4452 1360 1ADC.tmp 151 PID 4452 wrote to memory of 1924 4452 1B69.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_c0e86687b902292802361bc54b0be36e_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_c0e86687b902292802361bc54b0be36e_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\EA18.tmp"C:\Users\Admin\AppData\Local\Temp\EA18.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\EB60.tmp"C:\Users\Admin\AppData\Local\Temp\EB60.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\EC98.tmp"C:\Users\Admin\AppData\Local\Temp\EC98.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\EDB2.tmp"C:\Users\Admin\AppData\Local\Temp\EDB2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\EE9C.tmp"C:\Users\Admin\AppData\Local\Temp\EE9C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\EF09.tmp"C:\Users\Admin\AppData\Local\Temp\EF09.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\F294.tmp"C:\Users\Admin\AppData\Local\Temp\F294.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\F37E.tmp"C:\Users\Admin\AppData\Local\Temp\F37E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\F822.tmp"C:\Users\Admin\AppData\Local\Temp\F822.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\F92B.tmp"C:\Users\Admin\AppData\Local\Temp\F92B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\FC29.tmp"C:\Users\Admin\AppData\Local\Temp\FC29.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\FB.tmp"C:\Users\Admin\AppData\Local\Temp\FB.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\1E6.tmp"C:\Users\Admin\AppData\Local\Temp\1E6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\2E0.tmp"C:\Users\Admin\AppData\Local\Temp\2E0.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3E9.tmp"C:\Users\Admin\AppData\Local\Temp\3E9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\512.tmp"C:\Users\Admin\AppData\Local\Temp\512.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\62B.tmp"C:\Users\Admin\AppData\Local\Temp\62B.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\735.tmp"C:\Users\Admin\AppData\Local\Temp\735.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\83F.tmp"C:\Users\Admin\AppData\Local\Temp\83F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\919.tmp"C:\Users\Admin\AppData\Local\Temp\919.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\9D5.tmp"C:\Users\Admin\AppData\Local\Temp\9D5.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\A71.tmp"C:\Users\Admin\AppData\Local\Temp\A71.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\AFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFE.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\B9A.tmp"C:\Users\Admin\AppData\Local\Temp\B9A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\C17.tmp"C:\Users\Admin\AppData\Local\Temp\C17.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\CC3.tmp"C:\Users\Admin\AppData\Local\Temp\CC3.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\D40.tmp"C:\Users\Admin\AppData\Local\Temp\D40.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\DCC.tmp"C:\Users\Admin\AppData\Local\Temp\DCC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\F63.tmp"C:\Users\Admin\AppData\Local\Temp\F63.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\101E.tmp"C:\Users\Admin\AppData\Local\Temp\101E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\10AB.tmp"C:\Users\Admin\AppData\Local\Temp\10AB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\1157.tmp"C:\Users\Admin\AppData\Local\Temp\1157.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\1231.tmp"C:\Users\Admin\AppData\Local\Temp\1231.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\130C.tmp"C:\Users\Admin\AppData\Local\Temp\130C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\13A8.tmp"C:\Users\Admin\AppData\Local\Temp\13A8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\1445.tmp"C:\Users\Admin\AppData\Local\Temp\1445.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\14E1.tmp"C:\Users\Admin\AppData\Local\Temp\14E1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\155E.tmp"C:\Users\Admin\AppData\Local\Temp\155E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\15DB.tmp"C:\Users\Admin\AppData\Local\Temp\15DB.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\1668.tmp"C:\Users\Admin\AppData\Local\Temp\1668.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\16F4.tmp"C:\Users\Admin\AppData\Local\Temp\16F4.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\1781.tmp"C:\Users\Admin\AppData\Local\Temp\1781.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\17FE.tmp"C:\Users\Admin\AppData\Local\Temp\17FE.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\188A.tmp"C:\Users\Admin\AppData\Local\Temp\188A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\1936.tmp"C:\Users\Admin\AppData\Local\Temp\1936.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\19C3.tmp"C:\Users\Admin\AppData\Local\Temp\19C3.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1A40.tmp"C:\Users\Admin\AppData\Local\Temp\1A40.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\1B69.tmp"C:\Users\Admin\AppData\Local\Temp\1B69.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"65⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\1C53.tmp"C:\Users\Admin\AppData\Local\Temp\1C53.tmp"66⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"67⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"68⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"69⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\1E57.tmp"C:\Users\Admin\AppData\Local\Temp\1E57.tmp"70⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"71⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\1F70.tmp"C:\Users\Admin\AppData\Local\Temp\1F70.tmp"72⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"73⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\205A.tmp"C:\Users\Admin\AppData\Local\Temp\205A.tmp"74⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"75⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\2154.tmp"C:\Users\Admin\AppData\Local\Temp\2154.tmp"76⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\21E1.tmp"C:\Users\Admin\AppData\Local\Temp\21E1.tmp"77⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\22AC.tmp"C:\Users\Admin\AppData\Local\Temp\22AC.tmp"78⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2339.tmp"C:\Users\Admin\AppData\Local\Temp\2339.tmp"79⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\23D5.tmp"C:\Users\Admin\AppData\Local\Temp\23D5.tmp"80⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2471.tmp"C:\Users\Admin\AppData\Local\Temp\2471.tmp"81⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"82⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"83⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"84⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"85⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\2721.tmp"C:\Users\Admin\AppData\Local\Temp\2721.tmp"86⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\27BD.tmp"C:\Users\Admin\AppData\Local\Temp\27BD.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\282A.tmp"C:\Users\Admin\AppData\Local\Temp\282A.tmp"88⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\28A7.tmp"C:\Users\Admin\AppData\Local\Temp\28A7.tmp"89⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\2934.tmp"C:\Users\Admin\AppData\Local\Temp\2934.tmp"90⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\29C1.tmp"C:\Users\Admin\AppData\Local\Temp\29C1.tmp"91⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"92⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"93⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\2B67.tmp"C:\Users\Admin\AppData\Local\Temp\2B67.tmp"94⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"95⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\2C70.tmp"C:\Users\Admin\AppData\Local\Temp\2C70.tmp"96⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\2CDE.tmp"C:\Users\Admin\AppData\Local\Temp\2CDE.tmp"97⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"98⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"99⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2E64.tmp"C:\Users\Admin\AppData\Local\Temp\2E64.tmp"100⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2F00.tmp"C:\Users\Admin\AppData\Local\Temp\2F00.tmp"101⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\2F6E.tmp"C:\Users\Admin\AppData\Local\Temp\2F6E.tmp"102⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\2FDB.tmp"C:\Users\Admin\AppData\Local\Temp\2FDB.tmp"103⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\3068.tmp"C:\Users\Admin\AppData\Local\Temp\3068.tmp"104⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\30E5.tmp"C:\Users\Admin\AppData\Local\Temp\30E5.tmp"105⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\3171.tmp"C:\Users\Admin\AppData\Local\Temp\3171.tmp"106⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\31EE.tmp"C:\Users\Admin\AppData\Local\Temp\31EE.tmp"107⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\326B.tmp"C:\Users\Admin\AppData\Local\Temp\326B.tmp"108⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\3317.tmp"C:\Users\Admin\AppData\Local\Temp\3317.tmp"109⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\3394.tmp"C:\Users\Admin\AppData\Local\Temp\3394.tmp"110⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\3411.tmp"C:\Users\Admin\AppData\Local\Temp\3411.tmp"111⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\34AE.tmp"C:\Users\Admin\AppData\Local\Temp\34AE.tmp"112⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\352B.tmp"C:\Users\Admin\AppData\Local\Temp\352B.tmp"113⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\35A8.tmp"C:\Users\Admin\AppData\Local\Temp\35A8.tmp"114⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3625.tmp"C:\Users\Admin\AppData\Local\Temp\3625.tmp"115⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\36A2.tmp"C:\Users\Admin\AppData\Local\Temp\36A2.tmp"116⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\372E.tmp"C:\Users\Admin\AppData\Local\Temp\372E.tmp"117⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\379C.tmp"C:\Users\Admin\AppData\Local\Temp\379C.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\3828.tmp"C:\Users\Admin\AppData\Local\Temp\3828.tmp"119⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\3896.tmp"C:\Users\Admin\AppData\Local\Temp\3896.tmp"120⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\3922.tmp"C:\Users\Admin\AppData\Local\Temp\3922.tmp"121⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3990.tmp"C:\Users\Admin\AppData\Local\Temp\3990.tmp"122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-