Analysis
- max time kernel
128s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 04:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_065b3564577c9e7a5dc9df1c8d29d17d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_065b3564577c9e7a5dc9df1c8d29d17d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-28_065b3564577c9e7a5dc9df1c8d29d17d_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260728-flratsyzcs
- SHA256 a90e3fb27a139ffb21771bcf245a86ced284f39fdd4060719eccad9a14f98977
- MD5 065b3564577c9e7a5dc9df1c8d29d17d
- SHA1 59fc45a15a4a45ba6d62da49fb17c81f59f87eb2
- SHA512 57caf7cd035bd96c643cb37e8a78fe71476227c25033da4e8a6f3e3ed7942d870f3a63f790ab3ba0a46861e32dc5e99417b0c4b24bf635b31345552ebc1523a8
- SSDEEP 12288:NU5rCOTeijF8sMKK1x3V2ZSTB6ZBr6E7D9RTZwlH4Hp:NUQOJj3KLF2ZaEj3LTSlH4Hp
- TLSH T155B4F026B685C133E6C202321ED6DBB26A3E7C35532594C33B94626E2FB17E1D376306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3956 AF80.tmp 5988 B01C.tmp 6080 B0E7.tmp 5688 B2BC.tmp 3856 B329.tmp 280 B3D5.tmp 3164 B471.tmp 2140 B52D.tmp 52 B59A.tmp 5792 B646.tmp 2580 B702.tmp 5112 B7EC.tmp 724 B8A8.tmp 4176 B973.tmp 5304 B9FF.tmp 2260 BA9C.tmp 632 BB19.tmp 2032 BBA5.tmp 4448 BC41.tmp 1116 BCAF.tmp 1028 BD99.tmp 916 BE26.tmp 5896 BED2.tmp 1960 BF8D.tmp 1088 C078.tmp 4356 C0F5.tmp 3972 C1DF.tmp 5868 C2C9.tmp 2716 C3C3.tmp 5956 C460.tmp 1300 C4FC.tmp 4368 C598.tmp 4220 C663.tmp 3664 C70F.tmp 5840 C7AB.tmp 5972 C838.tmp 1592 C8A5.tmp 4932 C913.tmp 4396 C99F.tmp 4884 CA0D.tmp 3316 CA8A.tmp 5876 CB16.tmp 1144 CBA3.tmp 4108 CC20.tmp 244 CC9D.tmp 4100 CD39.tmp 1064 CDA7.tmp 1572 CE43.tmp 1272 CEC0.tmp 3064 CF3D.tmp 728 CFD9.tmp 5648 D037.tmp 1176 D0C3.tmp 5476 D160.tmp 5816 D1CD.tmp 5808 D279.tmp 4424 D334.tmp 4684 D3B1.tmp 1348 D43E.tmp 1372 D4DA.tmp 5940 D548.tmp 2800 D5E4.tmp 2684 D661.tmp 3444 D6FD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 774F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9101.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E88C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 535C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 831C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2789.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 883C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 727D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 548A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D816.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F55E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF7B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 3956 2776 2026-07-28_065b3564577c9e7a5dc9df1c8d29d17d_elex_mafia_stealc_tofsee.exe 89 PID 3956 wrote to memory of 5988 3956 AF80.tmp 90 PID 5988 wrote to memory of 6080 5988 B01C.tmp 91 PID 6080 wrote to memory of 5688 6080 B0E7.tmp 92 PID 5688 wrote to memory of 3856 5688 B2BC.tmp 93 PID 3856 wrote to memory of 280 3856 B329.tmp 94 PID 280 wrote to memory of 3164 280 B3D5.tmp 95 PID 3164 wrote to memory of 2140 3164 B471.tmp 96 PID 2140 wrote to memory of 52 2140 B52D.tmp 97 PID 52 wrote to memory of 5792 52 B59A.tmp 98 PID 5792 wrote to memory of 2580 5792 B646.tmp 99 PID 2580 wrote to memory of 5112 2580 B702.tmp 100 PID 5112 wrote to memory of 724 5112 B7EC.tmp 101 PID 724 wrote to memory of 4176 724 B8A8.tmp 102 PID 4176 wrote to memory of 5304 4176 B973.tmp 103 PID 5304 wrote to memory of 2260 5304 B9FF.tmp 104 PID 2260 wrote to memory of 632 2260 BA9C.tmp 105 PID 632 wrote to memory of 2032 632 BB19.tmp 106 PID 2032 wrote to memory of 4448 2032 BBA5.tmp 107 PID 4448 wrote to memory of 1116 4448 BC41.tmp 108 PID 1116 wrote to memory of 1028 1116 BCAF.tmp 109 PID 1028 wrote to memory of 916 1028 BD99.tmp 110 PID 916 wrote to memory of 5896 916 BE26.tmp 111 PID 5896 wrote to memory of 1960 5896 BED2.tmp 112 PID 1960 wrote to memory of 1088 1960 BF8D.tmp 113 PID 1088 wrote to memory of 4356 1088 C078.tmp 114 PID 4356 wrote to memory of 3972 4356 C0F5.tmp 115 PID 3972 wrote to memory of 5868 3972 C1DF.tmp 116 PID 5868 wrote to memory of 2716 5868 C2C9.tmp 117 PID 2716 wrote to memory of 5956 2716 C3C3.tmp 118 PID 5956 wrote to memory of 1300 5956 C460.tmp 119 PID 1300 wrote to memory of 4368 1300 C4FC.tmp 120 PID 4368 wrote to memory of 4220 4368 C598.tmp 121 PID 4220 wrote to memory of 3664 4220 C663.tmp 122 PID 3664 wrote to memory of 5840 3664 C70F.tmp 123 PID 5840 wrote to memory of 5972 5840 C7AB.tmp 124 PID 5972 wrote to memory of 1592 5972 C838.tmp 125 PID 1592 wrote to memory of 4932 1592 C8A5.tmp 126 PID 4932 wrote to memory of 4396 4932 C913.tmp 127 PID 4396 wrote to memory of 4884 4396 C99F.tmp 128 PID 4884 wrote to memory of 3316 4884 CA0D.tmp 129 PID 3316 wrote to memory of 5876 3316 CA8A.tmp 130 PID 5876 wrote to memory of 1144 5876 CB16.tmp 131 PID 1144 wrote to memory of 4108 1144 CBA3.tmp 132 PID 4108 wrote to memory of 244 4108 CC20.tmp 133 PID 244 wrote to memory of 4100 244 CC9D.tmp 134 PID 4100 wrote to memory of 1064 4100 CD39.tmp 135 PID 1064 wrote to memory of 1572 1064 CDA7.tmp 136 PID 1572 wrote to memory of 1272 1572 CE43.tmp 137 PID 1272 wrote to memory of 3064 1272 CEC0.tmp 138 PID 3064 wrote to memory of 728 3064 CF3D.tmp 139 PID 728 wrote to memory of 5648 728 CFD9.tmp 140 PID 5648 wrote to memory of 1176 5648 D037.tmp 141 PID 1176 wrote to memory of 5476 1176 D0C3.tmp 142 PID 5476 wrote to memory of 5816 5476 D160.tmp 143 PID 5816 wrote to memory of 5808 5816 D1CD.tmp 144 PID 5808 wrote to memory of 4424 5808 D279.tmp 145 PID 4424 wrote to memory of 4684 4424 D334.tmp 146 PID 4684 wrote to memory of 1348 4684 D3B1.tmp 147 PID 1348 wrote to memory of 1372 1348 D43E.tmp 148 PID 1372 wrote to memory of 5940 1372 D4DA.tmp 149 PID 5940 wrote to memory of 2800 5940 D548.tmp 150 PID 2800 wrote to memory of 2684 2800 D5E4.tmp 151 PID 2684 wrote to memory of 3444 2684 D661.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_065b3564577c9e7a5dc9df1c8d29d17d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_065b3564577c9e7a5dc9df1c8d29d17d_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\AF80.tmp"C:\Users\Admin\AppData\Local\Temp\AF80.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\B01C.tmp"C:\Users\Admin\AppData\Local\Temp\B01C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\B52D.tmp"C:\Users\Admin\AppData\Local\Temp\B52D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\B59A.tmp"C:\Users\Admin\AppData\Local\Temp\B59A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\B646.tmp"C:\Users\Admin\AppData\Local\Temp\B646.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\B702.tmp"C:\Users\Admin\AppData\Local\Temp\B702.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\B7EC.tmp"C:\Users\Admin\AppData\Local\Temp\B7EC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\B973.tmp"C:\Users\Admin\AppData\Local\Temp\B973.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\BB19.tmp"C:\Users\Admin\AppData\Local\Temp\BB19.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\BC41.tmp"C:\Users\Admin\AppData\Local\Temp\BC41.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\BE26.tmp"C:\Users\Admin\AppData\Local\Temp\BE26.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\BED2.tmp"C:\Users\Admin\AppData\Local\Temp\BED2.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\BF8D.tmp"C:\Users\Admin\AppData\Local\Temp\BF8D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\C078.tmp"C:\Users\Admin\AppData\Local\Temp\C078.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\C460.tmp"C:\Users\Admin\AppData\Local\Temp\C460.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\C598.tmp"C:\Users\Admin\AppData\Local\Temp\C598.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\C663.tmp"C:\Users\Admin\AppData\Local\Temp\C663.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\C70F.tmp"C:\Users\Admin\AppData\Local\Temp\C70F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\C838.tmp"C:\Users\Admin\AppData\Local\Temp\C838.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\C8A5.tmp"C:\Users\Admin\AppData\Local\Temp\C8A5.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\C913.tmp"C:\Users\Admin\AppData\Local\Temp\C913.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\C99F.tmp"C:\Users\Admin\AppData\Local\Temp\C99F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\CB16.tmp"C:\Users\Admin\AppData\Local\Temp\CB16.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\CC20.tmp"C:\Users\Admin\AppData\Local\Temp\CC20.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\CD39.tmp"C:\Users\Admin\AppData\Local\Temp\CD39.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\CDA7.tmp"C:\Users\Admin\AppData\Local\Temp\CDA7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\CE43.tmp"C:\Users\Admin\AppData\Local\Temp\CE43.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\CEC0.tmp"C:\Users\Admin\AppData\Local\Temp\CEC0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\D037.tmp"C:\Users\Admin\AppData\Local\Temp\D037.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\D160.tmp"C:\Users\Admin\AppData\Local\Temp\D160.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\D279.tmp"C:\Users\Admin\AppData\Local\Temp\D279.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\D334.tmp"C:\Users\Admin\AppData\Local\Temp\D334.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\D43E.tmp"C:\Users\Admin\AppData\Local\Temp\D43E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\D4DA.tmp"C:\Users\Admin\AppData\Local\Temp\D4DA.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\D661.tmp"C:\Users\Admin\AppData\Local\Temp\D661.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"65⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"66⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\D816.tmp"C:\Users\Admin\AppData\Local\Temp\D816.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"68⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"69⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"70⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"71⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"72⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\DB53.tmp"C:\Users\Admin\AppData\Local\Temp\DB53.tmp"73⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\DBFE.tmp"C:\Users\Admin\AppData\Local\Temp\DBFE.tmp"74⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"75⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\DD66.tmp"C:\Users\Admin\AppData\Local\Temp\DD66.tmp"76⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\DE12.tmp"C:\Users\Admin\AppData\Local\Temp\DE12.tmp"77⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"78⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\DF89.tmp"C:\Users\Admin\AppData\Local\Temp\DF89.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\E025.tmp"C:\Users\Admin\AppData\Local\Temp\E025.tmp"80⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\E0A2.tmp"C:\Users\Admin\AppData\Local\Temp\E0A2.tmp"81⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\E10F.tmp"C:\Users\Admin\AppData\Local\Temp\E10F.tmp"82⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\E18C.tmp"C:\Users\Admin\AppData\Local\Temp\E18C.tmp"83⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\E229.tmp"C:\Users\Admin\AppData\Local\Temp\E229.tmp"84⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\E296.tmp"C:\Users\Admin\AppData\Local\Temp\E296.tmp"85⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\E332.tmp"C:\Users\Admin\AppData\Local\Temp\E332.tmp"86⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"87⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\E46B.tmp"C:\Users\Admin\AppData\Local\Temp\E46B.tmp"88⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\E507.tmp"C:\Users\Admin\AppData\Local\Temp\E507.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"90⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\E64F.tmp"C:\Users\Admin\AppData\Local\Temp\E64F.tmp"91⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"92⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\E788.tmp"C:\Users\Admin\AppData\Local\Temp\E788.tmp"93⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\E814.tmp"C:\Users\Admin\AppData\Local\Temp\E814.tmp"94⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"95⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\E93D.tmp"C:\Users\Admin\AppData\Local\Temp\E93D.tmp"96⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\E9CA.tmp"C:\Users\Admin\AppData\Local\Temp\E9CA.tmp"97⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\EA47.tmp"C:\Users\Admin\AppData\Local\Temp\EA47.tmp"98⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"99⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\EB41.tmp"C:\Users\Admin\AppData\Local\Temp\EB41.tmp"100⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\EBED.tmp"C:\Users\Admin\AppData\Local\Temp\EBED.tmp"101⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\EC79.tmp"C:\Users\Admin\AppData\Local\Temp\EC79.tmp"102⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"103⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\ED64.tmp"C:\Users\Admin\AppData\Local\Temp\ED64.tmp"104⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"105⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"106⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\EF29.tmp"C:\Users\Admin\AppData\Local\Temp\EF29.tmp"107⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\EF96.tmp"C:\Users\Admin\AppData\Local\Temp\EF96.tmp"108⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\F013.tmp"C:\Users\Admin\AppData\Local\Temp\F013.tmp"109⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"110⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\F12C.tmp"C:\Users\Admin\AppData\Local\Temp\F12C.tmp"111⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"112⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\F246.tmp"C:\Users\Admin\AppData\Local\Temp\F246.tmp"113⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"114⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\F35F.tmp"C:\Users\Admin\AppData\Local\Temp\F35F.tmp"115⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"116⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"117⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\F514.tmp"C:\Users\Admin\AppData\Local\Temp\F514.tmp"118⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\F591.tmp"C:\Users\Admin\AppData\Local\Temp\F591.tmp"119⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\F62E.tmp"C:\Users\Admin\AppData\Local\Temp\F62E.tmp"120⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"121⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\F785.tmp"C:\Users\Admin\AppData\Local\Temp\F785.tmp"122⤵PID:4620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-