Analysis
- max time kernel
119s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 10:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_ba19c84d3d8cc14eeb48afb67da6322b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_ba19c84d3d8cc14eeb48afb67da6322b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-27_ba19c84d3d8cc14eeb48afb67da6322b_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260727-l7d6aaad39
- SHA256 614b26d6d99157c86367eb10f7bda6bed6a83f20eff0161ece53dec1f358b2d3
- MD5 ba19c84d3d8cc14eeb48afb67da6322b
- SHA1 1d33d48831650dba8fdd9a6ad42835099d6879e8
- SHA512 ead9a2355d1ffe5adbf4a06ad7e1ec2a3be846a1bda8cc672b54d4ad8c1d674b4bc47ff116f4d901a2680e27b6b71ab8c7fd73a2f435084e2860242e928bdb6f
- SSDEEP 12288:NU5rCOTeijysXvB6WiXxAyEZfrHTtd3kMFy0ETZwlH:NUQOJjXXvB6xLUBFNETSlH
- TLSH T137B4F126B684C533E58301710AE6EBB1293A7C715B26A4C73B84677E2FB52D1E379307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2808 817B.tmp 4124 8217.tmp 936 8301.tmp 2084 839D.tmp 2452 843A.tmp 1432 8563.tmp 4252 863D.tmp 4660 86BA.tmp 2776 8747.tmp 2980 87F3.tmp 2544 888F.tmp 4924 894B.tmp 4548 89E7.tmp 5008 8AC2.tmp 616 8B2F.tmp 252 8BDB.tmp 5168 8C58.tmp 6120 8CF4.tmp 5512 8D71.tmp 2432 8E4C.tmp 5404 8EF8.tmp 4744 8F94.tmp 3740 9030.tmp 1080 90BD.tmp 5396 9159.tmp 1248 91D6.tmp 6012 9253.tmp 468 92E0.tmp 5076 936C.tmp 3416 9409.tmp 3540 94A5.tmp 1156 9551.tmp 1976 95DD.tmp 2920 962B.tmp 5380 96A8.tmp 2496 9745.tmp 2040 97C2.tmp 4516 982F.tmp 2276 98CB.tmp 5012 9948.tmp 1960 99A6.tmp 2416 9A33.tmp 3776 9AB0.tmp 5896 9B2D.tmp 4324 9BAA.tmp 2420 9C36.tmp 3760 9CB3.tmp 2244 9D40.tmp 4448 9DBD.tmp 1180 9E3A.tmp 5164 9EE6.tmp 200 9F63.tmp 4348 9FFF.tmp 4248 A07C.tmp 5352 A0F9.tmp 876 A176.tmp 4296 A1F3.tmp 4836 A280.tmp 4944 A2DD.tmp 4976 A36A.tmp 5936 A406.tmp 2256 A474.tmp 4108 A4F1.tmp 2596 A55E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 412C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F572.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 272C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 511A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1895.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5593.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F86B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 763B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A54A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 173.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F514.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 269F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 936C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA50.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1236 wrote to memory of 2808 1236 2026-07-27_ba19c84d3d8cc14eeb48afb67da6322b_elex_mafia_stealc_tofsee.exe 89 PID 2808 wrote to memory of 4124 2808 817B.tmp 90 PID 4124 wrote to memory of 936 4124 8217.tmp 91 PID 936 wrote to memory of 2084 936 8301.tmp 92 PID 2084 wrote to memory of 2452 2084 839D.tmp 93 PID 2452 wrote to memory of 1432 2452 843A.tmp 94 PID 1432 wrote to memory of 4252 1432 8563.tmp 95 PID 4252 wrote to memory of 4660 4252 863D.tmp 96 PID 4660 wrote to memory of 2776 4660 86BA.tmp 97 PID 2776 wrote to memory of 2980 2776 8747.tmp 98 PID 2980 wrote to memory of 2544 2980 87F3.tmp 99 PID 2544 wrote to memory of 4924 2544 888F.tmp 100 PID 4924 wrote to memory of 4548 4924 894B.tmp 101 PID 4548 wrote to memory of 5008 4548 89E7.tmp 102 PID 5008 wrote to memory of 616 5008 8AC2.tmp 103 PID 616 wrote to memory of 252 616 8B2F.tmp 104 PID 252 wrote to memory of 5168 252 8BDB.tmp 105 PID 5168 wrote to memory of 6120 5168 8C58.tmp 106 PID 6120 wrote to memory of 5512 6120 8CF4.tmp 107 PID 5512 wrote to memory of 2432 5512 8D71.tmp 108 PID 2432 wrote to memory of 5404 2432 8E4C.tmp 109 PID 5404 wrote to memory of 4744 5404 8EF8.tmp 110 PID 4744 wrote to memory of 3740 4744 8F94.tmp 111 PID 3740 wrote to memory of 1080 3740 9030.tmp 112 PID 1080 wrote to memory of 5396 1080 90BD.tmp 113 PID 5396 wrote to memory of 1248 5396 9159.tmp 114 PID 1248 wrote to memory of 6012 1248 91D6.tmp 115 PID 6012 wrote to memory of 468 6012 9253.tmp 116 PID 468 wrote to memory of 5076 468 92E0.tmp 117 PID 5076 wrote to memory of 3416 5076 936C.tmp 118 PID 3416 wrote to memory of 3540 3416 9409.tmp 119 PID 3540 wrote to memory of 1156 3540 94A5.tmp 120 PID 1156 wrote to memory of 1976 1156 9551.tmp 121 PID 1976 wrote to memory of 2920 1976 95DD.tmp 122 PID 2920 wrote to memory of 5380 2920 962B.tmp 123 PID 5380 wrote to memory of 2496 5380 96A8.tmp 124 PID 2496 wrote to memory of 2040 2496 9745.tmp 125 PID 2040 wrote to memory of 4516 2040 97C2.tmp 126 PID 4516 wrote to memory of 2276 4516 982F.tmp 127 PID 2276 wrote to memory of 5012 2276 98CB.tmp 128 PID 5012 wrote to memory of 1960 5012 9948.tmp 129 PID 1960 wrote to memory of 2416 1960 99A6.tmp 130 PID 2416 wrote to memory of 3776 2416 9A33.tmp 131 PID 3776 wrote to memory of 5896 3776 9AB0.tmp 132 PID 5896 wrote to memory of 4324 5896 9B2D.tmp 133 PID 4324 wrote to memory of 2420 4324 9BAA.tmp 134 PID 2420 wrote to memory of 3760 2420 9C36.tmp 135 PID 3760 wrote to memory of 2244 3760 9CB3.tmp 136 PID 2244 wrote to memory of 4448 2244 9D40.tmp 137 PID 4448 wrote to memory of 1180 4448 9DBD.tmp 138 PID 1180 wrote to memory of 5164 1180 9E3A.tmp 139 PID 5164 wrote to memory of 200 5164 9EE6.tmp 140 PID 200 wrote to memory of 4348 200 9F63.tmp 141 PID 4348 wrote to memory of 4248 4348 9FFF.tmp 142 PID 4248 wrote to memory of 5352 4248 A07C.tmp 143 PID 5352 wrote to memory of 876 5352 A0F9.tmp 144 PID 876 wrote to memory of 4296 876 A176.tmp 145 PID 4296 wrote to memory of 4836 4296 A1F3.tmp 146 PID 4836 wrote to memory of 4944 4836 A280.tmp 147 PID 4944 wrote to memory of 4976 4944 A2DD.tmp 148 PID 4976 wrote to memory of 5936 4976 A36A.tmp 149 PID 5936 wrote to memory of 2256 5936 A406.tmp 150 PID 2256 wrote to memory of 4108 2256 A474.tmp 151 PID 4108 wrote to memory of 2596 4108 A4F1.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_ba19c84d3d8cc14eeb48afb67da6322b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_ba19c84d3d8cc14eeb48afb67da6322b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\817B.tmp"C:\Users\Admin\AppData\Local\Temp\817B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\8217.tmp"C:\Users\Admin\AppData\Local\Temp\8217.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\8301.tmp"C:\Users\Admin\AppData\Local\Temp\8301.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\839D.tmp"C:\Users\Admin\AppData\Local\Temp\839D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\843A.tmp"C:\Users\Admin\AppData\Local\Temp\843A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\8563.tmp"C:\Users\Admin\AppData\Local\Temp\8563.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\87F3.tmp"C:\Users\Admin\AppData\Local\Temp\87F3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\888F.tmp"C:\Users\Admin\AppData\Local\Temp\888F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\8EF8.tmp"C:\Users\Admin\AppData\Local\Temp\8EF8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\8F94.tmp"C:\Users\Admin\AppData\Local\Temp\8F94.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\9030.tmp"C:\Users\Admin\AppData\Local\Temp\9030.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\90BD.tmp"C:\Users\Admin\AppData\Local\Temp\90BD.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\9159.tmp"C:\Users\Admin\AppData\Local\Temp\9159.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\91D6.tmp"C:\Users\Admin\AppData\Local\Temp\91D6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\9253.tmp"C:\Users\Admin\AppData\Local\Temp\9253.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\92E0.tmp"C:\Users\Admin\AppData\Local\Temp\92E0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\936C.tmp"C:\Users\Admin\AppData\Local\Temp\936C.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\9409.tmp"C:\Users\Admin\AppData\Local\Temp\9409.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\94A5.tmp"C:\Users\Admin\AppData\Local\Temp\94A5.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\9551.tmp"C:\Users\Admin\AppData\Local\Temp\9551.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\95DD.tmp"C:\Users\Admin\AppData\Local\Temp\95DD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\96A8.tmp"C:\Users\Admin\AppData\Local\Temp\96A8.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\9745.tmp"C:\Users\Admin\AppData\Local\Temp\9745.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\97C2.tmp"C:\Users\Admin\AppData\Local\Temp\97C2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\982F.tmp"C:\Users\Admin\AppData\Local\Temp\982F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\98CB.tmp"C:\Users\Admin\AppData\Local\Temp\98CB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\9948.tmp"C:\Users\Admin\AppData\Local\Temp\9948.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\99A6.tmp"C:\Users\Admin\AppData\Local\Temp\99A6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\9A33.tmp"C:\Users\Admin\AppData\Local\Temp\9A33.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\9B2D.tmp"C:\Users\Admin\AppData\Local\Temp\9B2D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\9BAA.tmp"C:\Users\Admin\AppData\Local\Temp\9BAA.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\9C36.tmp"C:\Users\Admin\AppData\Local\Temp\9C36.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\9D40.tmp"C:\Users\Admin\AppData\Local\Temp\9D40.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\9F63.tmp"C:\Users\Admin\AppData\Local\Temp\9F63.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\A07C.tmp"C:\Users\Admin\AppData\Local\Temp\A07C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\A0F9.tmp"C:\Users\Admin\AppData\Local\Temp\A0F9.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\A176.tmp"C:\Users\Admin\AppData\Local\Temp\A176.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\A280.tmp"C:\Users\Admin\AppData\Local\Temp\A280.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\A36A.tmp"C:\Users\Admin\AppData\Local\Temp\A36A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\A406.tmp"C:\Users\Admin\AppData\Local\Temp\A406.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\A474.tmp"C:\Users\Admin\AppData\Local\Temp\A474.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\A55E.tmp"C:\Users\Admin\AppData\Local\Temp\A55E.tmp"65⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A60A.tmp"C:\Users\Admin\AppData\Local\Temp\A60A.tmp"66⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\A677.tmp"C:\Users\Admin\AppData\Local\Temp\A677.tmp"67⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\A714.tmp"C:\Users\Admin\AppData\Local\Temp\A714.tmp"68⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\A781.tmp"C:\Users\Admin\AppData\Local\Temp\A781.tmp"69⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\A82D.tmp"C:\Users\Admin\AppData\Local\Temp\A82D.tmp"70⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"71⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\A936.tmp"C:\Users\Admin\AppData\Local\Temp\A936.tmp"72⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"73⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\AA50.tmp"C:\Users\Admin\AppData\Local\Temp\AA50.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\AADC.tmp"C:\Users\Admin\AppData\Local\Temp\AADC.tmp"75⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\AB59.tmp"C:\Users\Admin\AppData\Local\Temp\AB59.tmp"76⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\AC05.tmp"C:\Users\Admin\AppData\Local\Temp\AC05.tmp"77⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\AC73.tmp"C:\Users\Admin\AppData\Local\Temp\AC73.tmp"78⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"79⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"80⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\AE18.tmp"C:\Users\Admin\AppData\Local\Temp\AE18.tmp"81⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\AE95.tmp"C:\Users\Admin\AppData\Local\Temp\AE95.tmp"82⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\AF22.tmp"C:\Users\Admin\AppData\Local\Temp\AF22.tmp"83⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"84⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"85⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"86⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"87⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"88⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"89⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"90⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\B349.tmp"C:\Users\Admin\AppData\Local\Temp\B349.tmp"91⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\B462.tmp"C:\Users\Admin\AppData\Local\Temp\B462.tmp"93⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"94⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\B54C.tmp"C:\Users\Admin\AppData\Local\Temp\B54C.tmp"95⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"96⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\B637.tmp"C:\Users\Admin\AppData\Local\Temp\B637.tmp"97⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"98⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\B731.tmp"C:\Users\Admin\AppData\Local\Temp\B731.tmp"99⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"100⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\B859.tmp"C:\Users\Admin\AppData\Local\Temp\B859.tmp"101⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\B905.tmp"C:\Users\Admin\AppData\Local\Temp\B905.tmp"102⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"103⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"104⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"105⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\BB19.tmp"C:\Users\Admin\AppData\Local\Temp\BB19.tmp"106⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\BB96.tmp"C:\Users\Admin\AppData\Local\Temp\BB96.tmp"107⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"108⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\BC70.tmp"C:\Users\Admin\AppData\Local\Temp\BC70.tmp"109⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"110⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\BDA9.tmp"C:\Users\Admin\AppData\Local\Temp\BDA9.tmp"111⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\BE45.tmp"C:\Users\Admin\AppData\Local\Temp\BE45.tmp"112⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"113⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"114⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\BFAC.tmp"C:\Users\Admin\AppData\Local\Temp\BFAC.tmp"115⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\C039.tmp"C:\Users\Admin\AppData\Local\Temp\C039.tmp"116⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"117⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\C123.tmp"C:\Users\Admin\AppData\Local\Temp\C123.tmp"118⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"119⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"120⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"121⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\C366.tmp"C:\Users\Admin\AppData\Local\Temp\C366.tmp"122⤵PID:1964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-