Analysis
- max time kernel
126s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/07/2026, 23:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-26_655582ef1e8c2a82a4ac191a9eb01090_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-26_655582ef1e8c2a82a4ac191a9eb01090_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-26_655582ef1e8c2a82a4ac191a9eb01090_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260726-3wefcage42
- SHA256 46009ddc51852a6d23f70cacc5b39210ef02929b7703fdb81b3e1917d3d6302d
- MD5 655582ef1e8c2a82a4ac191a9eb01090
- SHA1 78647f34ab75776a939124e4db2bd3b31f78dcfd
- SHA512 e75ed3af94bfb2e8c6a7b111ee53368c5ad54892284b1ad129bb0f04a2e51797d35e074e309fa667ba6e46df769bace06396322f193ffd79be0435f53b9ceb0c
- SSDEEP 12288:9U5rCOTei69W8XChFaVC8/WqZoXWjdqpby1grA70G+o:9UQOJ69WZsF/WqqGh4yATXo
- TLSH T12BE40222B585C032E9D711304EE6EBB1697A7D35A72264C77B80676E2FB02E1D378317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2416 B387.tmp 4288 B414.tmp 4564 B4EE.tmp 1844 B685.tmp 3352 B750.tmp 4200 B7DC.tmp 1184 B8A8.tmp 4900 B9A2.tmp 5724 BA6D.tmp 1488 BACA.tmp 4304 BBB5.tmp 5624 BC51.tmp 4112 BD0D.tmp 4676 BDB8.tmp 840 BE74.tmp 5660 BF3F.tmp 4088 BFCC.tmp 1500 C097.tmp 2880 C181.tmp 1156 C21D.tmp 1776 C2D9.tmp 1072 C385.tmp 4808 C440.tmp 3404 C4EC.tmp 3248 C579.tmp 5108 C605.tmp 6008 C6D1.tmp 5188 C77C.tmp 3668 C867.tmp 3004 C932.tmp 4860 C9BF.tmp 5572 CA6A.tmp 4520 CAE7.tmp 5668 CB64.tmp 2724 CBF1.tmp 4596 CC6E.tmp 5672 CCEB.tmp 5344 CD68.tmp 2604 CDC6.tmp 5404 CE43.tmp 2180 CEC0.tmp 5656 CF3D.tmp 6048 CFD9.tmp 1192 D066.tmp 2556 D0E3.tmp 1380 D16F.tmp 1576 D1EC.tmp 1508 D269.tmp 2720 D2E6.tmp 1504 D373.tmp 748 D3F0.tmp 2584 D46D.tmp 6072 D4FA.tmp 500 D577.tmp 4776 D5F4.tmp 1512 D680.tmp 3440 D70D.tmp 4100 D799.tmp 712 D816.tmp 3296 D8A3.tmp 3712 D920.tmp 5728 D9AD.tmp 5676 DA39.tmp 1216 DAD6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A847.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7849.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 943.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 775F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 921F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 343B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 635A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8454.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ED8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 827F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F96A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 889A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8837.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 122D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D816.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8113.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9269.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB8A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 2416 3980 2026-07-26_655582ef1e8c2a82a4ac191a9eb01090_elex_mafia_stealc_tofsee.exe 88 PID 2416 wrote to memory of 4288 2416 B387.tmp 89 PID 4288 wrote to memory of 4564 4288 B414.tmp 90 PID 4564 wrote to memory of 1844 4564 B4EE.tmp 91 PID 1844 wrote to memory of 3352 1844 B685.tmp 92 PID 3352 wrote to memory of 4200 3352 B750.tmp 93 PID 4200 wrote to memory of 1184 4200 B7DC.tmp 94 PID 1184 wrote to memory of 4900 1184 B8A8.tmp 95 PID 4900 wrote to memory of 5724 4900 B9A2.tmp 96 PID 5724 wrote to memory of 1488 5724 BA6D.tmp 97 PID 1488 wrote to memory of 4304 1488 BACA.tmp 98 PID 4304 wrote to memory of 5624 4304 BBB5.tmp 99 PID 5624 wrote to memory of 4112 5624 BC51.tmp 100 PID 4112 wrote to memory of 4676 4112 BD0D.tmp 101 PID 4676 wrote to memory of 840 4676 BDB8.tmp 102 PID 840 wrote to memory of 5660 840 BE74.tmp 103 PID 5660 wrote to memory of 4088 5660 BF3F.tmp 104 PID 4088 wrote to memory of 1500 4088 BFCC.tmp 105 PID 1500 wrote to memory of 2880 1500 C097.tmp 106 PID 2880 wrote to memory of 1156 2880 C181.tmp 107 PID 1156 wrote to memory of 1776 1156 C21D.tmp 108 PID 1776 wrote to memory of 1072 1776 C2D9.tmp 109 PID 1072 wrote to memory of 4808 1072 C385.tmp 110 PID 4808 wrote to memory of 3404 4808 C440.tmp 111 PID 3404 wrote to memory of 3248 3404 C4EC.tmp 112 PID 3248 wrote to memory of 5108 3248 C579.tmp 113 PID 5108 wrote to memory of 6008 5108 C605.tmp 114 PID 6008 wrote to memory of 5188 6008 C6D1.tmp 115 PID 5188 wrote to memory of 3668 5188 C77C.tmp 116 PID 3668 wrote to memory of 3004 3668 C867.tmp 117 PID 3004 wrote to memory of 4860 3004 C932.tmp 118 PID 4860 wrote to memory of 5572 4860 C9BF.tmp 119 PID 5572 wrote to memory of 4520 5572 CA6A.tmp 120 PID 4520 wrote to memory of 5668 4520 CAE7.tmp 121 PID 5668 wrote to memory of 2724 5668 CB64.tmp 122 PID 2724 wrote to memory of 4596 2724 CBF1.tmp 123 PID 4596 wrote to memory of 5672 4596 CC6E.tmp 124 PID 5672 wrote to memory of 5344 5672 CCEB.tmp 125 PID 5344 wrote to memory of 2604 5344 CD68.tmp 126 PID 2604 wrote to memory of 5404 2604 CDC6.tmp 127 PID 5404 wrote to memory of 2180 5404 CE43.tmp 128 PID 2180 wrote to memory of 5656 2180 CEC0.tmp 129 PID 5656 wrote to memory of 6048 5656 CF3D.tmp 130 PID 6048 wrote to memory of 1192 6048 CFD9.tmp 131 PID 1192 wrote to memory of 2556 1192 D066.tmp 132 PID 2556 wrote to memory of 1380 2556 D0E3.tmp 133 PID 1380 wrote to memory of 1576 1380 D16F.tmp 134 PID 1576 wrote to memory of 1508 1576 D1EC.tmp 135 PID 1508 wrote to memory of 2720 1508 D269.tmp 136 PID 2720 wrote to memory of 1504 2720 D2E6.tmp 137 PID 1504 wrote to memory of 748 1504 D373.tmp 138 PID 748 wrote to memory of 2584 748 D3F0.tmp 139 PID 2584 wrote to memory of 6072 2584 D46D.tmp 140 PID 6072 wrote to memory of 500 6072 D4FA.tmp 141 PID 500 wrote to memory of 4776 500 D577.tmp 142 PID 4776 wrote to memory of 1512 4776 D5F4.tmp 143 PID 1512 wrote to memory of 3440 1512 D680.tmp 144 PID 3440 wrote to memory of 4100 3440 D70D.tmp 145 PID 4100 wrote to memory of 712 4100 D799.tmp 146 PID 712 wrote to memory of 3296 712 D816.tmp 147 PID 3296 wrote to memory of 3712 3296 D8A3.tmp 148 PID 3712 wrote to memory of 5728 3712 D920.tmp 149 PID 5728 wrote to memory of 5676 5728 D9AD.tmp 150 PID 5676 wrote to memory of 1216 5676 DA39.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-26_655582ef1e8c2a82a4ac191a9eb01090_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-26_655582ef1e8c2a82a4ac191a9eb01090_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\B414.tmp"C:\Users\Admin\AppData\Local\Temp\B414.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\B685.tmp"C:\Users\Admin\AppData\Local\Temp\B685.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\B750.tmp"C:\Users\Admin\AppData\Local\Temp\B750.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\BA6D.tmp"C:\Users\Admin\AppData\Local\Temp\BA6D.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\BACA.tmp"C:\Users\Admin\AppData\Local\Temp\BACA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\BBB5.tmp"C:\Users\Admin\AppData\Local\Temp\BBB5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\BC51.tmp"C:\Users\Admin\AppData\Local\Temp\BC51.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\BDB8.tmp"C:\Users\Admin\AppData\Local\Temp\BDB8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\BE74.tmp"C:\Users\Admin\AppData\Local\Temp\BE74.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\C097.tmp"C:\Users\Admin\AppData\Local\Temp\C097.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\C181.tmp"C:\Users\Admin\AppData\Local\Temp\C181.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\C21D.tmp"C:\Users\Admin\AppData\Local\Temp\C21D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\C385.tmp"C:\Users\Admin\AppData\Local\Temp\C385.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\C440.tmp"C:\Users\Admin\AppData\Local\Temp\C440.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\C579.tmp"C:\Users\Admin\AppData\Local\Temp\C579.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\C605.tmp"C:\Users\Admin\AppData\Local\Temp\C605.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\C6D1.tmp"C:\Users\Admin\AppData\Local\Temp\C6D1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\C77C.tmp"C:\Users\Admin\AppData\Local\Temp\C77C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\C867.tmp"C:\Users\Admin\AppData\Local\Temp\C867.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\C932.tmp"C:\Users\Admin\AppData\Local\Temp\C932.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\CB64.tmp"C:\Users\Admin\AppData\Local\Temp\CB64.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\CD68.tmp"C:\Users\Admin\AppData\Local\Temp\CD68.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\CE43.tmp"C:\Users\Admin\AppData\Local\Temp\CE43.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\CEC0.tmp"C:\Users\Admin\AppData\Local\Temp\CEC0.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\D066.tmp"C:\Users\Admin\AppData\Local\Temp\D066.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\D16F.tmp"C:\Users\Admin\AppData\Local\Temp\D16F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\D269.tmp"C:\Users\Admin\AppData\Local\Temp\D269.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\D373.tmp"C:\Users\Admin\AppData\Local\Temp\D373.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\D46D.tmp"C:\Users\Admin\AppData\Local\Temp\D46D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\D577.tmp"C:\Users\Admin\AppData\Local\Temp\D577.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\D680.tmp"C:\Users\Admin\AppData\Local\Temp\D680.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\D799.tmp"C:\Users\Admin\AppData\Local\Temp\D799.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\D816.tmp"C:\Users\Admin\AppData\Local\Temp\D816.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"65⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\DB43.tmp"C:\Users\Admin\AppData\Local\Temp\DB43.tmp"66⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"67⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\DC3D.tmp"C:\Users\Admin\AppData\Local\Temp\DC3D.tmp"68⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"69⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\DD27.tmp"C:\Users\Admin\AppData\Local\Temp\DD27.tmp"70⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"71⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\DE31.tmp"C:\Users\Admin\AppData\Local\Temp\DE31.tmp"72⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"73⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\DF1B.tmp"C:\Users\Admin\AppData\Local\Temp\DF1B.tmp"74⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\DF89.tmp"C:\Users\Admin\AppData\Local\Temp\DF89.tmp"75⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\E015.tmp"C:\Users\Admin\AppData\Local\Temp\E015.tmp"76⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"77⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\E100.tmp"C:\Users\Admin\AppData\Local\Temp\E100.tmp"78⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\E19C.tmp"C:\Users\Admin\AppData\Local\Temp\E19C.tmp"79⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\E238.tmp"C:\Users\Admin\AppData\Local\Temp\E238.tmp"80⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"81⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\E332.tmp"C:\Users\Admin\AppData\Local\Temp\E332.tmp"82⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"83⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\E42C.tmp"C:\Users\Admin\AppData\Local\Temp\E42C.tmp"84⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"85⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\E526.tmp"C:\Users\Admin\AppData\Local\Temp\E526.tmp"86⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"87⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\E611.tmp"C:\Users\Admin\AppData\Local\Temp\E611.tmp"88⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\E6BC.tmp"C:\Users\Admin\AppData\Local\Temp\E6BC.tmp"89⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\E72A.tmp"C:\Users\Admin\AppData\Local\Temp\E72A.tmp"90⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\E797.tmp"C:\Users\Admin\AppData\Local\Temp\E797.tmp"91⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\E805.tmp"C:\Users\Admin\AppData\Local\Temp\E805.tmp"92⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"93⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\E90E.tmp"C:\Users\Admin\AppData\Local\Temp\E90E.tmp"94⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\E98B.tmp"C:\Users\Admin\AppData\Local\Temp\E98B.tmp"95⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\EA27.tmp"C:\Users\Admin\AppData\Local\Temp\EA27.tmp"96⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"97⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\EB12.tmp"C:\Users\Admin\AppData\Local\Temp\EB12.tmp"98⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\EB8F.tmp"C:\Users\Admin\AppData\Local\Temp\EB8F.tmp"99⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"100⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\EC79.tmp"C:\Users\Admin\AppData\Local\Temp\EC79.tmp"101⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\ED06.tmp"C:\Users\Admin\AppData\Local\Temp\ED06.tmp"102⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\ED92.tmp"C:\Users\Admin\AppData\Local\Temp\ED92.tmp"103⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"104⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"105⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\EF29.tmp"C:\Users\Admin\AppData\Local\Temp\EF29.tmp"106⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"107⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\F023.tmp"C:\Users\Admin\AppData\Local\Temp\F023.tmp"108⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"109⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\F13C.tmp"C:\Users\Admin\AppData\Local\Temp\F13C.tmp"110⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"111⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\F294.tmp"C:\Users\Admin\AppData\Local\Temp\F294.tmp"112⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\F311.tmp"C:\Users\Admin\AppData\Local\Temp\F311.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\F39D.tmp"C:\Users\Admin\AppData\Local\Temp\F39D.tmp"114⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\F41A.tmp"C:\Users\Admin\AppData\Local\Temp\F41A.tmp"115⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\F488.tmp"C:\Users\Admin\AppData\Local\Temp\F488.tmp"116⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"117⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"118⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\F60E.tmp"C:\Users\Admin\AppData\Local\Temp\F60E.tmp"119⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\F68B.tmp"C:\Users\Admin\AppData\Local\Temp\F68B.tmp"120⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\F708.tmp"C:\Users\Admin\AppData\Local\Temp\F708.tmp"121⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\F785.tmp"C:\Users\Admin\AppData\Local\Temp\F785.tmp"122⤵PID:4184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-