Analysis
- max time kernel
118s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-21_edd42b804dd9422bf0cac69d4003b83c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-21_edd42b804dd9422bf0cac69d4003b83c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-21_edd42b804dd9422bf0cac69d4003b83c_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260721-txadcazfpd
- SHA256 a5a1624c0d8265d1c656aeccb2a31f415582ad083765e4a994bcc1d504e30080
- MD5 edd42b804dd9422bf0cac69d4003b83c
- SHA1 a34d32643d7df485ce0d767f97775e886431c845
- SHA512 2c3a06fb48c6741ebe96d07597878d48916538158b3acc123bf526459a01694d9db0061d7b7ae0326157c295b9ab888b619028474ef4ccf702056503d7bd0b91
- SSDEEP 12288:HU5rCOTeiJdbSjBV/6BaXS193RpDG1VO/BnNZ:HUQOJJ8jWB+eBQ6N
- TLSH T168B4E126B585C432E69211354EE6EBB1593A7C314722A0CB3B84777E2FB12E1E778347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6136 B3D5.tmp 3996 B471.tmp 5008 B56B.tmp 5032 B6C3.tmp 1596 B78E.tmp 5200 B7FC.tmp 1332 B888.tmp 4780 B944.tmp 4508 B9E0.tmp 4016 BA9C.tmp 5568 BB28.tmp 4980 BBD4.tmp 6064 BC9F.tmp 5940 BD8A.tmp 2596 BE26.tmp 5864 BE93.tmp 5576 BF3F.tmp 4340 BFEB.tmp 4976 C0B6.tmp 2348 C133.tmp 4080 C1DF.tmp 3876 C29A.tmp 2404 C346.tmp 1796 C3F2.tmp 5240 C47F.tmp 3152 C4FC.tmp 3472 C5B7.tmp 5040 C682.tmp 4772 C70F.tmp 2984 C7AB.tmp 612 C848.tmp 1876 C903.tmp 4628 C9CE.tmp 4520 CA6A.tmp 5668 CAD8.tmp 2724 CB45.tmp 4596 CBC2.tmp 5672 CC5E.tmp 5344 CCDB.tmp 2604 CD49.tmp 5404 CDD5.tmp 5948 CE62.tmp 5656 CEEF.tmp 6048 CF6C.tmp 1192 CFD9.tmp 2556 D056.tmp 1380 D0E3.tmp 1576 D17F.tmp 1508 D1EC.tmp 2720 D269.tmp 1504 D315.tmp 748 D392.tmp 2584 D40F.tmp 6072 D48C.tmp 500 D4FA.tmp 4196 D596.tmp 5972 D613.tmp 3440 D6AF.tmp 4100 D73C.tmp 712 D7C8.tmp 3296 D855.tmp 3712 D8E2.tmp 5728 D94F.tmp 5676 D9CC.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 147E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 159.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 858D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B16F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C39F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7859.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D94F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ED1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 760C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 6136 3980 2026-07-21_edd42b804dd9422bf0cac69d4003b83c_elex_mafia_stealc_tofsee.exe 88 PID 6136 wrote to memory of 3996 6136 B3D5.tmp 89 PID 3996 wrote to memory of 5008 3996 B471.tmp 90 PID 5008 wrote to memory of 5032 5008 B56B.tmp 91 PID 5032 wrote to memory of 1596 5032 B6C3.tmp 92 PID 1596 wrote to memory of 5200 1596 B78E.tmp 93 PID 5200 wrote to memory of 1332 5200 B7FC.tmp 94 PID 1332 wrote to memory of 4780 1332 B888.tmp 95 PID 4780 wrote to memory of 4508 4780 B944.tmp 96 PID 4508 wrote to memory of 4016 4508 B9E0.tmp 97 PID 4016 wrote to memory of 5568 4016 BA9C.tmp 98 PID 5568 wrote to memory of 4980 5568 BB28.tmp 99 PID 4980 wrote to memory of 6064 4980 BBD4.tmp 100 PID 6064 wrote to memory of 5940 6064 BC9F.tmp 101 PID 5940 wrote to memory of 2596 5940 BD8A.tmp 102 PID 2596 wrote to memory of 5864 2596 BE26.tmp 103 PID 5864 wrote to memory of 5576 5864 BE93.tmp 104 PID 5576 wrote to memory of 4340 5576 BF3F.tmp 105 PID 4340 wrote to memory of 4976 4340 BFEB.tmp 106 PID 4976 wrote to memory of 2348 4976 C0B6.tmp 107 PID 2348 wrote to memory of 4080 2348 C133.tmp 108 PID 4080 wrote to memory of 3876 4080 C1DF.tmp 109 PID 3876 wrote to memory of 2404 3876 C29A.tmp 110 PID 2404 wrote to memory of 1796 2404 C346.tmp 111 PID 1796 wrote to memory of 5240 1796 C3F2.tmp 112 PID 5240 wrote to memory of 3152 5240 C47F.tmp 113 PID 3152 wrote to memory of 3472 3152 C4FC.tmp 114 PID 3472 wrote to memory of 5040 3472 C5B7.tmp 115 PID 5040 wrote to memory of 4772 5040 C682.tmp 116 PID 4772 wrote to memory of 2984 4772 C70F.tmp 117 PID 2984 wrote to memory of 612 2984 C7AB.tmp 118 PID 612 wrote to memory of 1876 612 C848.tmp 119 PID 1876 wrote to memory of 4628 1876 C903.tmp 120 PID 4628 wrote to memory of 4520 4628 C9CE.tmp 121 PID 4520 wrote to memory of 5668 4520 CA6A.tmp 122 PID 5668 wrote to memory of 2724 5668 CAD8.tmp 123 PID 2724 wrote to memory of 4596 2724 CB45.tmp 124 PID 4596 wrote to memory of 5672 4596 CBC2.tmp 125 PID 5672 wrote to memory of 5344 5672 CC5E.tmp 126 PID 5344 wrote to memory of 2604 5344 CCDB.tmp 127 PID 2604 wrote to memory of 5404 2604 CD49.tmp 128 PID 5404 wrote to memory of 5948 5404 CDD5.tmp 129 PID 5948 wrote to memory of 5656 5948 CE62.tmp 130 PID 5656 wrote to memory of 6048 5656 CEEF.tmp 131 PID 6048 wrote to memory of 1192 6048 CF6C.tmp 132 PID 1192 wrote to memory of 2556 1192 CFD9.tmp 133 PID 2556 wrote to memory of 1380 2556 D056.tmp 134 PID 1380 wrote to memory of 1576 1380 D0E3.tmp 135 PID 1576 wrote to memory of 1508 1576 D17F.tmp 136 PID 1508 wrote to memory of 2720 1508 D1EC.tmp 137 PID 2720 wrote to memory of 1504 2720 D269.tmp 138 PID 1504 wrote to memory of 748 1504 D315.tmp 139 PID 748 wrote to memory of 2584 748 D392.tmp 140 PID 2584 wrote to memory of 6072 2584 D40F.tmp 141 PID 6072 wrote to memory of 500 6072 D48C.tmp 142 PID 500 wrote to memory of 4196 500 D4FA.tmp 143 PID 4196 wrote to memory of 5972 4196 D596.tmp 144 PID 5972 wrote to memory of 3440 5972 D613.tmp 145 PID 3440 wrote to memory of 4100 3440 D6AF.tmp 146 PID 4100 wrote to memory of 712 4100 D73C.tmp 147 PID 712 wrote to memory of 3296 712 D7C8.tmp 148 PID 3296 wrote to memory of 3712 3296 D855.tmp 149 PID 3712 wrote to memory of 5728 3712 D8E2.tmp 150 PID 5728 wrote to memory of 5676 5728 D94F.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_edd42b804dd9422bf0cac69d4003b83c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_edd42b804dd9422bf0cac69d4003b83c_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\B56B.tmp"C:\Users\Admin\AppData\Local\Temp\B56B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\B78E.tmp"C:\Users\Admin\AppData\Local\Temp\B78E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\B888.tmp"C:\Users\Admin\AppData\Local\Temp\B888.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\B944.tmp"C:\Users\Admin\AppData\Local\Temp\B944.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\BB28.tmp"C:\Users\Admin\AppData\Local\Temp\BB28.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\BE26.tmp"C:\Users\Admin\AppData\Local\Temp\BE26.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\BE93.tmp"C:\Users\Admin\AppData\Local\Temp\BE93.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\C133.tmp"C:\Users\Admin\AppData\Local\Temp\C133.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\C29A.tmp"C:\Users\Admin\AppData\Local\Temp\C29A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\C346.tmp"C:\Users\Admin\AppData\Local\Temp\C346.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\C47F.tmp"C:\Users\Admin\AppData\Local\Temp\C47F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\C682.tmp"C:\Users\Admin\AppData\Local\Temp\C682.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\C70F.tmp"C:\Users\Admin\AppData\Local\Temp\C70F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\C848.tmp"C:\Users\Admin\AppData\Local\Temp\C848.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\C903.tmp"C:\Users\Admin\AppData\Local\Temp\C903.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\CAD8.tmp"C:\Users\Admin\AppData\Local\Temp\CAD8.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\CB45.tmp"C:\Users\Admin\AppData\Local\Temp\CB45.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\CBC2.tmp"C:\Users\Admin\AppData\Local\Temp\CBC2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\CC5E.tmp"C:\Users\Admin\AppData\Local\Temp\CC5E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\CCDB.tmp"C:\Users\Admin\AppData\Local\Temp\CCDB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\CD49.tmp"C:\Users\Admin\AppData\Local\Temp\CD49.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\CDD5.tmp"C:\Users\Admin\AppData\Local\Temp\CDD5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\CE62.tmp"C:\Users\Admin\AppData\Local\Temp\CE62.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\D056.tmp"C:\Users\Admin\AppData\Local\Temp\D056.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\D17F.tmp"C:\Users\Admin\AppData\Local\Temp\D17F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\D269.tmp"C:\Users\Admin\AppData\Local\Temp\D269.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\D315.tmp"C:\Users\Admin\AppData\Local\Temp\D315.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\D392.tmp"C:\Users\Admin\AppData\Local\Temp\D392.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\D40F.tmp"C:\Users\Admin\AppData\Local\Temp\D40F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\D48C.tmp"C:\Users\Admin\AppData\Local\Temp\D48C.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Users\Admin\AppData\Local\Temp\D596.tmp"C:\Users\Admin\AppData\Local\Temp\D596.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\D613.tmp"C:\Users\Admin\AppData\Local\Temp\D613.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\D6AF.tmp"C:\Users\Admin\AppData\Local\Temp\D6AF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\D73C.tmp"C:\Users\Admin\AppData\Local\Temp\D73C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\D94F.tmp"C:\Users\Admin\AppData\Local\Temp\D94F.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"65⤵
- Executes dropped EXE
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"66⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"67⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\DB43.tmp"C:\Users\Admin\AppData\Local\Temp\DB43.tmp"68⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"69⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"70⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\DD08.tmp"C:\Users\Admin\AppData\Local\Temp\DD08.tmp"72⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"73⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\DE21.tmp"C:\Users\Admin\AppData\Local\Temp\DE21.tmp"74⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"75⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"76⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"77⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\E063.tmp"C:\Users\Admin\AppData\Local\Temp\E063.tmp"78⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\E10F.tmp"C:\Users\Admin\AppData\Local\Temp\E10F.tmp"79⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"80⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\E238.tmp"C:\Users\Admin\AppData\Local\Temp\E238.tmp"81⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"82⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\E332.tmp"C:\Users\Admin\AppData\Local\Temp\E332.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"84⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\E44B.tmp"C:\Users\Admin\AppData\Local\Temp\E44B.tmp"85⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"86⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\E555.tmp"C:\Users\Admin\AppData\Local\Temp\E555.tmp"87⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"88⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\E630.tmp"C:\Users\Admin\AppData\Local\Temp\E630.tmp"89⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"90⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\E71A.tmp"C:\Users\Admin\AppData\Local\Temp\E71A.tmp"91⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"92⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\E833.tmp"C:\Users\Admin\AppData\Local\Temp\E833.tmp"93⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\E8C0.tmp"C:\Users\Admin\AppData\Local\Temp\E8C0.tmp"94⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\E95C.tmp"C:\Users\Admin\AppData\Local\Temp\E95C.tmp"95⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"96⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\EA76.tmp"C:\Users\Admin\AppData\Local\Temp\EA76.tmp"97⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\EB12.tmp"C:\Users\Admin\AppData\Local\Temp\EB12.tmp"98⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"99⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"100⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\EC98.tmp"C:\Users\Admin\AppData\Local\Temp\EC98.tmp"101⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\ED06.tmp"C:\Users\Admin\AppData\Local\Temp\ED06.tmp"102⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"103⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"104⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"105⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\EF29.tmp"C:\Users\Admin\AppData\Local\Temp\EF29.tmp"106⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"107⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\F032.tmp"C:\Users\Admin\AppData\Local\Temp\F032.tmp"108⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"109⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\F10D.tmp"C:\Users\Admin\AppData\Local\Temp\F10D.tmp"110⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\F19A.tmp"C:\Users\Admin\AppData\Local\Temp\F19A.tmp"111⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\F217.tmp"C:\Users\Admin\AppData\Local\Temp\F217.tmp"112⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\F284.tmp"C:\Users\Admin\AppData\Local\Temp\F284.tmp"113⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\F320.tmp"C:\Users\Admin\AppData\Local\Temp\F320.tmp"114⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\F39D.tmp"C:\Users\Admin\AppData\Local\Temp\F39D.tmp"115⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\F449.tmp"C:\Users\Admin\AppData\Local\Temp\F449.tmp"116⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"117⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"118⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"119⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\F63D.tmp"C:\Users\Admin\AppData\Local\Temp\F63D.tmp"120⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"121⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\F728.tmp"C:\Users\Admin\AppData\Local\Temp\F728.tmp"122⤵PID:932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-