Analysis
- max time kernel
125s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_0fc5c9bdc0ee394de42a160bf185c89d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_0fc5c9bdc0ee394de42a160bf185c89d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-22_0fc5c9bdc0ee394de42a160bf185c89d_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260722-e13rqsydqa
- SHA256 73db29c2c184c9adc51b27a8ca1e0dad8c6f7c953ecab70f95a0cfb13f66e0ca
- MD5 0fc5c9bdc0ee394de42a160bf185c89d
- SHA1 af0740f4537083cfac71882f574f8f4b90f8d8e1
- SHA512 5ac06aaea99764ede0f0d61896bd624314c9ebf9f6c8e9b95cfafeb41d559e83f6ba62f21f57ff93f2cd0fae15547521cc23a84803e729984ddfa31a0b9fdb0f
- SSDEEP 12288:wU5rCOTeiDTbTvgaec8R2BbVfkNPYQNZ+3/v+I9hUG2VA:wUQOJDvTwPRoBfkNgQNGEA
- TLSH T172E4D02173E8C532E5FB037859B5E6614D7EBD225722D6CF2F8016AE0AB1BC09631763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3368 8207.tmp 6048 838E.tmp 2256 8543.tmp 1124 868B.tmp 1772 8812.tmp 1620 88FC.tmp 704 8A16.tmp 2632 8B5E.tmp 2044 8C67.tmp 5264 8D90.tmp 4760 8EAA.tmp 6060 8FC3.tmp 936 90BD.tmp 5008 91F5.tmp 3720 92E0.tmp 4500 9418.tmp 1584 9531.tmp 2924 9699.tmp 3904 9793.tmp 4776 986E.tmp 3408 9987.tmp 5540 9A90.tmp 4108 9B7B.tmp 3936 9C94.tmp 4828 9D8E.tmp 2640 9EE6.tmp 5460 9FEF.tmp 2180 A0E9.tmp 1720 A1E3.tmp 3676 A31C.tmp 1028 A454.tmp 2416 A55E.tmp 4588 A6A6.tmp 5504 A762.tmp 4448 A81D.tmp 6140 A8D9.tmp 2464 A9C3.tmp 4728 AA8E.tmp 4424 AB79.tmp 5868 AC44.tmp 4084 ACFF.tmp 5420 ADCA.tmp 5440 AE95.tmp 6044 AF61.tmp 3240 B01C.tmp 3176 B106.tmp 3136 B1C2.tmp 3512 B29D.tmp 3404 B339.tmp 360 B3C6.tmp 5516 B452.tmp 2576 B4DF.tmp 4616 B56B.tmp 3304 B617.tmp 4244 B6A4.tmp 4660 B750.tmp 4504 B7CD.tmp 5248 B84A.tmp 4372 B8D6.tmp 4132 B992.tmp 4100 BA4D.tmp 3596 BADA.tmp 4392 BB57.tmp 5068 BBE4.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 152F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A29A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4864.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B641.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4017.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 762B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A52A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2806.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3053.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C70F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 734D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D23A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C90E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E04F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9878.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D310.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D821.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3593.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 634A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2859.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 353A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F1.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1188 wrote to memory of 3368 1188 2026-07-22_0fc5c9bdc0ee394de42a160bf185c89d_elex_mafia_stealc_tofsee.exe 89 PID 3368 wrote to memory of 6048 3368 8207.tmp 90 PID 6048 wrote to memory of 2256 6048 838E.tmp 91 PID 2256 wrote to memory of 1124 2256 8543.tmp 92 PID 1124 wrote to memory of 1772 1124 868B.tmp 93 PID 1772 wrote to memory of 1620 1772 8812.tmp 94 PID 1620 wrote to memory of 704 1620 88FC.tmp 95 PID 704 wrote to memory of 2632 704 8A16.tmp 96 PID 2632 wrote to memory of 2044 2632 8B5E.tmp 97 PID 2044 wrote to memory of 5264 2044 8C67.tmp 98 PID 5264 wrote to memory of 4760 5264 8D90.tmp 99 PID 4760 wrote to memory of 6060 4760 8EAA.tmp 100 PID 6060 wrote to memory of 936 6060 8FC3.tmp 101 PID 936 wrote to memory of 5008 936 90BD.tmp 102 PID 5008 wrote to memory of 3720 5008 91F5.tmp 103 PID 3720 wrote to memory of 4500 3720 92E0.tmp 104 PID 4500 wrote to memory of 1584 4500 9418.tmp 105 PID 1584 wrote to memory of 2924 1584 9531.tmp 106 PID 2924 wrote to memory of 3904 2924 9699.tmp 107 PID 3904 wrote to memory of 4776 3904 9793.tmp 108 PID 4776 wrote to memory of 3408 4776 986E.tmp 109 PID 3408 wrote to memory of 5540 3408 9987.tmp 110 PID 5540 wrote to memory of 4108 5540 9A90.tmp 111 PID 4108 wrote to memory of 3936 4108 9B7B.tmp 112 PID 3936 wrote to memory of 4828 3936 9C94.tmp 113 PID 4828 wrote to memory of 2640 4828 9D8E.tmp 114 PID 2640 wrote to memory of 5460 2640 9EE6.tmp 115 PID 5460 wrote to memory of 2180 5460 9FEF.tmp 116 PID 2180 wrote to memory of 1720 2180 A0E9.tmp 117 PID 1720 wrote to memory of 3676 1720 A1E3.tmp 118 PID 3676 wrote to memory of 1028 3676 A31C.tmp 119 PID 1028 wrote to memory of 2416 1028 A454.tmp 120 PID 2416 wrote to memory of 4588 2416 A55E.tmp 121 PID 4588 wrote to memory of 5504 4588 A6A6.tmp 122 PID 5504 wrote to memory of 4448 5504 A762.tmp 123 PID 4448 wrote to memory of 6140 4448 A81D.tmp 124 PID 6140 wrote to memory of 2464 6140 A8D9.tmp 125 PID 2464 wrote to memory of 4728 2464 A9C3.tmp 126 PID 4728 wrote to memory of 4424 4728 AA8E.tmp 127 PID 4424 wrote to memory of 5868 4424 AB79.tmp 128 PID 5868 wrote to memory of 4084 5868 AC44.tmp 129 PID 4084 wrote to memory of 5420 4084 ACFF.tmp 130 PID 5420 wrote to memory of 5440 5420 ADCA.tmp 131 PID 5440 wrote to memory of 6044 5440 AE95.tmp 132 PID 6044 wrote to memory of 3240 6044 AF61.tmp 133 PID 3240 wrote to memory of 3176 3240 B01C.tmp 134 PID 3176 wrote to memory of 3136 3176 B106.tmp 135 PID 3136 wrote to memory of 3512 3136 B1C2.tmp 136 PID 3512 wrote to memory of 3404 3512 B29D.tmp 137 PID 3404 wrote to memory of 360 3404 B339.tmp 138 PID 360 wrote to memory of 5516 360 B3C6.tmp 139 PID 5516 wrote to memory of 2576 5516 B452.tmp 140 PID 2576 wrote to memory of 4616 2576 B4DF.tmp 141 PID 4616 wrote to memory of 3304 4616 B56B.tmp 142 PID 3304 wrote to memory of 4244 3304 B617.tmp 143 PID 4244 wrote to memory of 4660 4244 B6A4.tmp 144 PID 4660 wrote to memory of 4504 4660 B750.tmp 145 PID 4504 wrote to memory of 5248 4504 B7CD.tmp 146 PID 5248 wrote to memory of 4372 5248 B84A.tmp 147 PID 4372 wrote to memory of 4132 4372 B8D6.tmp 148 PID 4132 wrote to memory of 4100 4132 B992.tmp 149 PID 4100 wrote to memory of 3596 4100 BA4D.tmp 150 PID 3596 wrote to memory of 4392 3596 BADA.tmp 151 PID 4392 wrote to memory of 5068 4392 BB57.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_0fc5c9bdc0ee394de42a160bf185c89d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_0fc5c9bdc0ee394de42a160bf185c89d_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\8207.tmp"C:\Users\Admin\AppData\Local\Temp\8207.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\838E.tmp"C:\Users\Admin\AppData\Local\Temp\838E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\868B.tmp"C:\Users\Admin\AppData\Local\Temp\868B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\8812.tmp"C:\Users\Admin\AppData\Local\Temp\8812.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\88FC.tmp"C:\Users\Admin\AppData\Local\Temp\88FC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\8A16.tmp"C:\Users\Admin\AppData\Local\Temp\8A16.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\8C67.tmp"C:\Users\Admin\AppData\Local\Temp\8C67.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\90BD.tmp"C:\Users\Admin\AppData\Local\Temp\90BD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\91F5.tmp"C:\Users\Admin\AppData\Local\Temp\91F5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\92E0.tmp"C:\Users\Admin\AppData\Local\Temp\92E0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\9418.tmp"C:\Users\Admin\AppData\Local\Temp\9418.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\9531.tmp"C:\Users\Admin\AppData\Local\Temp\9531.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\9699.tmp"C:\Users\Admin\AppData\Local\Temp\9699.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\986E.tmp"C:\Users\Admin\AppData\Local\Temp\986E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\9987.tmp"C:\Users\Admin\AppData\Local\Temp\9987.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\9A90.tmp"C:\Users\Admin\AppData\Local\Temp\9A90.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\9B7B.tmp"C:\Users\Admin\AppData\Local\Temp\9B7B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\9C94.tmp"C:\Users\Admin\AppData\Local\Temp\9C94.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\A1E3.tmp"C:\Users\Admin\AppData\Local\Temp\A1E3.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\A31C.tmp"C:\Users\Admin\AppData\Local\Temp\A31C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\A454.tmp"C:\Users\Admin\AppData\Local\Temp\A454.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\A55E.tmp"C:\Users\Admin\AppData\Local\Temp\A55E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\A6A6.tmp"C:\Users\Admin\AppData\Local\Temp\A6A6.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\A762.tmp"C:\Users\Admin\AppData\Local\Temp\A762.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\A81D.tmp"C:\Users\Admin\AppData\Local\Temp\A81D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\A8D9.tmp"C:\Users\Admin\AppData\Local\Temp\A8D9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\AA8E.tmp"C:\Users\Admin\AppData\Local\Temp\AA8E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\AB79.tmp"C:\Users\Admin\AppData\Local\Temp\AB79.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\AC44.tmp"C:\Users\Admin\AppData\Local\Temp\AC44.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\AE95.tmp"C:\Users\Admin\AppData\Local\Temp\AE95.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\AF61.tmp"C:\Users\Admin\AppData\Local\Temp\AF61.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\B01C.tmp"C:\Users\Admin\AppData\Local\Temp\B01C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\B452.tmp"C:\Users\Admin\AppData\Local\Temp\B452.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\B56B.tmp"C:\Users\Admin\AppData\Local\Temp\B56B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\B617.tmp"C:\Users\Admin\AppData\Local\Temp\B617.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\B750.tmp"C:\Users\Admin\AppData\Local\Temp\B750.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\B84A.tmp"C:\Users\Admin\AppData\Local\Temp\B84A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\B992.tmp"C:\Users\Admin\AppData\Local\Temp\B992.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\BADA.tmp"C:\Users\Admin\AppData\Local\Temp\BADA.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\BB57.tmp"C:\Users\Admin\AppData\Local\Temp\BB57.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\BBE4.tmp"C:\Users\Admin\AppData\Local\Temp\BBE4.tmp"65⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\BC80.tmp"C:\Users\Admin\AppData\Local\Temp\BC80.tmp"66⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"67⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"68⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\BE26.tmp"C:\Users\Admin\AppData\Local\Temp\BE26.tmp"69⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"70⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"71⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"72⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\C039.tmp"C:\Users\Admin\AppData\Local\Temp\C039.tmp"73⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"74⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\C143.tmp"C:\Users\Admin\AppData\Local\Temp\C143.tmp"75⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\C1CF.tmp"C:\Users\Admin\AppData\Local\Temp\C1CF.tmp"76⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\C25C.tmp"C:\Users\Admin\AppData\Local\Temp\C25C.tmp"77⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"78⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\C375.tmp"C:\Users\Admin\AppData\Local\Temp\C375.tmp"79⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"80⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\C46F.tmp"C:\Users\Admin\AppData\Local\Temp\C46F.tmp"81⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\C54A.tmp"C:\Users\Admin\AppData\Local\Temp\C54A.tmp"82⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\C605.tmp"C:\Users\Admin\AppData\Local\Temp\C605.tmp"83⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\C6A2.tmp"C:\Users\Admin\AppData\Local\Temp\C6A2.tmp"84⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\C70F.tmp"C:\Users\Admin\AppData\Local\Temp\C70F.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"86⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\C848.tmp"C:\Users\Admin\AppData\Local\Temp\C848.tmp"87⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"88⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\C942.tmp"C:\Users\Admin\AppData\Local\Temp\C942.tmp"89⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"90⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"91⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\CB16.tmp"C:\Users\Admin\AppData\Local\Temp\CB16.tmp"92⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\CB93.tmp"C:\Users\Admin\AppData\Local\Temp\CB93.tmp"93⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\CC30.tmp"C:\Users\Admin\AppData\Local\Temp\CC30.tmp"94⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\CCDB.tmp"C:\Users\Admin\AppData\Local\Temp\CCDB.tmp"95⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\CD39.tmp"C:\Users\Admin\AppData\Local\Temp\CD39.tmp"96⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"97⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\CE62.tmp"C:\Users\Admin\AppData\Local\Temp\CE62.tmp"98⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\CF0E.tmp"C:\Users\Admin\AppData\Local\Temp\CF0E.tmp"99⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"100⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"101⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\D075.tmp"C:\Users\Admin\AppData\Local\Temp\D075.tmp"102⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\D121.tmp"C:\Users\Admin\AppData\Local\Temp\D121.tmp"103⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"104⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\D23A.tmp"C:\Users\Admin\AppData\Local\Temp\D23A.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"106⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\D334.tmp"C:\Users\Admin\AppData\Local\Temp\D334.tmp"107⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"108⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\D44E.tmp"C:\Users\Admin\AppData\Local\Temp\D44E.tmp"109⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"110⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\D577.tmp"C:\Users\Admin\AppData\Local\Temp\D577.tmp"111⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"112⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\D680.tmp"C:\Users\Admin\AppData\Local\Temp\D680.tmp"113⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\D72C.tmp"C:\Users\Admin\AppData\Local\Temp\D72C.tmp"114⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"115⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"116⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"118⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"119⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\DA59.tmp"C:\Users\Admin\AppData\Local\Temp\DA59.tmp"120⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"121⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\DB72.tmp"C:\Users\Admin\AppData\Local\Temp\DB72.tmp"122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-