Analysis
- max time kernel
119s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_885d3ad3239f2bd080b20587d08351da_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_885d3ad3239f2bd080b20587d08351da_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-28_885d3ad3239f2bd080b20587d08351da_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260728-vm7rja1bme
- SHA256 01ed8bcec2e586192217245aa4b9187ae085eecfb42d400e2eb3098f63976ea9
- MD5 885d3ad3239f2bd080b20587d08351da
- SHA1 fd3b0be61bfe1b3371047a5e72fcfec601926703
- SHA512 1bf2ca98c85a332001941367090588f2e918f62336c6e5ffaa490bda2ca75f88f0437cc1dd6697207cf0a2401f787c6c6f77236f97cf0b6b0bb83c9541e145c9
- SSDEEP 12288:NU5rCOTeijvrJEJmPs+0tPONWUTKBqjkTZwlH4Hp:NUQOJjvtEj+MyaTSlH4Hp
- TLSH T1D2B4F116B685C233E5C302715AD6EBA26A3ABC71572694C33B94A33E2B717D1D376303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4224 1A16.tmp 4100 1B00.tmp 3300 1C39.tmp 2280 1DCF.tmp 3200 1EAA.tmp 2324 1F75.tmp 1924 205F.tmp 1120 212A.tmp 1324 2205.tmp 4936 22E0.tmp 2632 236C.tmp 3552 2428.tmp 4992 24D4.tmp 5412 2551.tmp 408 25DD.tmp 5340 26A9.tmp 6080 2745.tmp 5092 2820.tmp 5216 28BC.tmp 5768 2958.tmp 1912 29E5.tmp 5476 2A91.tmp 428 2B2D.tmp 3264 2BF8.tmp 4980 2CF2.tmp 4736 2DAD.tmp 4692 2E4A.tmp 2456 2F15.tmp 1816 2FA1.tmp 2056 305D.tmp 5680 3118.tmp 3644 3212.tmp 2860 32BE.tmp 2912 334B.tmp 1792 33B8.tmp 3012 3445.tmp 3848 34C2.tmp 4400 355E.tmp 2364 35DB.tmp 2580 3649.tmp 1880 36C6.tmp 2104 3743.tmp 4196 37C0.tmp 2320 384C.tmp 1052 38E8.tmp 2856 3994.tmp 5604 3A21.tmp 5416 3AAE.tmp 5560 3B1B.tmp 4516 3BA8.tmp 3852 3C25.tmp 1868 3CB1.tmp 5956 3D4D.tmp 2532 3DCA.tmp 3316 3E76.tmp 464 3F22.tmp 5720 3F9F.tmp 1208 404B.tmp 2768 40D8.tmp 4324 4164.tmp 4892 41E1.tmp 2956 425E.tmp 5376 42EB.tmp 4620 4387.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 283A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E715.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9040.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 930A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 985E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D25A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D969.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B77F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 419E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_885d3ad3239f2bd080b20587d08351da_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2745.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D10D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E502.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A956.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C58.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4220 wrote to memory of 4224 4220 2026-07-28_885d3ad3239f2bd080b20587d08351da_elex_mafia_stealc_tofsee.exe 89 PID 4224 wrote to memory of 4100 4224 1A16.tmp 90 PID 4100 wrote to memory of 3300 4100 1B00.tmp 91 PID 3300 wrote to memory of 2280 3300 1C39.tmp 92 PID 2280 wrote to memory of 3200 2280 1DCF.tmp 93 PID 3200 wrote to memory of 2324 3200 1EAA.tmp 94 PID 2324 wrote to memory of 1924 2324 1F75.tmp 95 PID 1924 wrote to memory of 1120 1924 205F.tmp 96 PID 1120 wrote to memory of 1324 1120 212A.tmp 97 PID 1324 wrote to memory of 4936 1324 2205.tmp 98 PID 4936 wrote to memory of 2632 4936 22E0.tmp 99 PID 2632 wrote to memory of 3552 2632 236C.tmp 100 PID 3552 wrote to memory of 4992 3552 2428.tmp 101 PID 4992 wrote to memory of 5412 4992 24D4.tmp 102 PID 5412 wrote to memory of 408 5412 2551.tmp 103 PID 408 wrote to memory of 5340 408 25DD.tmp 104 PID 5340 wrote to memory of 6080 5340 26A9.tmp 105 PID 6080 wrote to memory of 5092 6080 2745.tmp 106 PID 5092 wrote to memory of 5216 5092 2820.tmp 107 PID 5216 wrote to memory of 5768 5216 28BC.tmp 108 PID 5768 wrote to memory of 1912 5768 2958.tmp 109 PID 1912 wrote to memory of 5476 1912 29E5.tmp 110 PID 5476 wrote to memory of 428 5476 2A91.tmp 111 PID 428 wrote to memory of 3264 428 2B2D.tmp 112 PID 3264 wrote to memory of 4980 3264 2BF8.tmp 113 PID 4980 wrote to memory of 4736 4980 2CF2.tmp 114 PID 4736 wrote to memory of 4692 4736 2DAD.tmp 115 PID 4692 wrote to memory of 2456 4692 2E4A.tmp 116 PID 2456 wrote to memory of 1816 2456 2F15.tmp 117 PID 1816 wrote to memory of 2056 1816 2FA1.tmp 118 PID 2056 wrote to memory of 5680 2056 305D.tmp 119 PID 5680 wrote to memory of 3644 5680 3118.tmp 120 PID 3644 wrote to memory of 2860 3644 3212.tmp 121 PID 2860 wrote to memory of 2912 2860 32BE.tmp 122 PID 2912 wrote to memory of 1792 2912 334B.tmp 123 PID 1792 wrote to memory of 3012 1792 33B8.tmp 124 PID 3012 wrote to memory of 3848 3012 3445.tmp 125 PID 3848 wrote to memory of 4400 3848 34C2.tmp 126 PID 4400 wrote to memory of 2364 4400 355E.tmp 127 PID 2364 wrote to memory of 2580 2364 35DB.tmp 128 PID 2580 wrote to memory of 1880 2580 3649.tmp 129 PID 1880 wrote to memory of 2104 1880 36C6.tmp 130 PID 2104 wrote to memory of 4196 2104 3743.tmp 131 PID 4196 wrote to memory of 2320 4196 37C0.tmp 132 PID 2320 wrote to memory of 1052 2320 384C.tmp 133 PID 1052 wrote to memory of 2856 1052 38E8.tmp 134 PID 2856 wrote to memory of 5604 2856 3994.tmp 135 PID 5604 wrote to memory of 5416 5604 3A21.tmp 136 PID 5416 wrote to memory of 5560 5416 3AAE.tmp 137 PID 5560 wrote to memory of 4516 5560 3B1B.tmp 138 PID 4516 wrote to memory of 3852 4516 3BA8.tmp 139 PID 3852 wrote to memory of 1868 3852 3C25.tmp 140 PID 1868 wrote to memory of 5956 1868 3CB1.tmp 141 PID 5956 wrote to memory of 2532 5956 3D4D.tmp 142 PID 2532 wrote to memory of 3316 2532 3DCA.tmp 143 PID 3316 wrote to memory of 464 3316 3E76.tmp 144 PID 464 wrote to memory of 5720 464 3F22.tmp 145 PID 5720 wrote to memory of 1208 5720 3F9F.tmp 146 PID 1208 wrote to memory of 2768 1208 404B.tmp 147 PID 2768 wrote to memory of 4324 2768 40D8.tmp 148 PID 4324 wrote to memory of 4892 4324 4164.tmp 149 PID 4892 wrote to memory of 2956 4892 41E1.tmp 150 PID 2956 wrote to memory of 5376 2956 425E.tmp 151 PID 5376 wrote to memory of 4620 5376 42EB.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_885d3ad3239f2bd080b20587d08351da_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_885d3ad3239f2bd080b20587d08351da_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\1C39.tmp"C:\Users\Admin\AppData\Local\Temp\1C39.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\1DCF.tmp"C:\Users\Admin\AppData\Local\Temp\1DCF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\1EAA.tmp"C:\Users\Admin\AppData\Local\Temp\1EAA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\205F.tmp"C:\Users\Admin\AppData\Local\Temp\205F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\212A.tmp"C:\Users\Admin\AppData\Local\Temp\212A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\2205.tmp"C:\Users\Admin\AppData\Local\Temp\2205.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\22E0.tmp"C:\Users\Admin\AppData\Local\Temp\22E0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\236C.tmp"C:\Users\Admin\AppData\Local\Temp\236C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2428.tmp"C:\Users\Admin\AppData\Local\Temp\2428.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\24D4.tmp"C:\Users\Admin\AppData\Local\Temp\24D4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\2551.tmp"C:\Users\Admin\AppData\Local\Temp\2551.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\25DD.tmp"C:\Users\Admin\AppData\Local\Temp\25DD.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\26A9.tmp"C:\Users\Admin\AppData\Local\Temp\26A9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\2745.tmp"C:\Users\Admin\AppData\Local\Temp\2745.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\28BC.tmp"C:\Users\Admin\AppData\Local\Temp\28BC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\2958.tmp"C:\Users\Admin\AppData\Local\Temp\2958.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\29E5.tmp"C:\Users\Admin\AppData\Local\Temp\29E5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\2A91.tmp"C:\Users\Admin\AppData\Local\Temp\2A91.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\2B2D.tmp"C:\Users\Admin\AppData\Local\Temp\2B2D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\2E4A.tmp"C:\Users\Admin\AppData\Local\Temp\2E4A.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\2F15.tmp"C:\Users\Admin\AppData\Local\Temp\2F15.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\305D.tmp"C:\Users\Admin\AppData\Local\Temp\305D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3118.tmp"C:\Users\Admin\AppData\Local\Temp\3118.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\3212.tmp"C:\Users\Admin\AppData\Local\Temp\3212.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\32BE.tmp"C:\Users\Admin\AppData\Local\Temp\32BE.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\334B.tmp"C:\Users\Admin\AppData\Local\Temp\334B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\33B8.tmp"C:\Users\Admin\AppData\Local\Temp\33B8.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3445.tmp"C:\Users\Admin\AppData\Local\Temp\3445.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\34C2.tmp"C:\Users\Admin\AppData\Local\Temp\34C2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\355E.tmp"C:\Users\Admin\AppData\Local\Temp\355E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\35DB.tmp"C:\Users\Admin\AppData\Local\Temp\35DB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\3649.tmp"C:\Users\Admin\AppData\Local\Temp\3649.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\36C6.tmp"C:\Users\Admin\AppData\Local\Temp\36C6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\3743.tmp"C:\Users\Admin\AppData\Local\Temp\3743.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\37C0.tmp"C:\Users\Admin\AppData\Local\Temp\37C0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\384C.tmp"C:\Users\Admin\AppData\Local\Temp\384C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\38E8.tmp"C:\Users\Admin\AppData\Local\Temp\38E8.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\3994.tmp"C:\Users\Admin\AppData\Local\Temp\3994.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3A21.tmp"C:\Users\Admin\AppData\Local\Temp\3A21.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\3C25.tmp"C:\Users\Admin\AppData\Local\Temp\3C25.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3E76.tmp"C:\Users\Admin\AppData\Local\Temp\3E76.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\40D8.tmp"C:\Users\Admin\AppData\Local\Temp\40D8.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\41E1.tmp"C:\Users\Admin\AppData\Local\Temp\41E1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\425E.tmp"C:\Users\Admin\AppData\Local\Temp\425E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\42EB.tmp"C:\Users\Admin\AppData\Local\Temp\42EB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\4387.tmp"C:\Users\Admin\AppData\Local\Temp\4387.tmp"65⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\4414.tmp"C:\Users\Admin\AppData\Local\Temp\4414.tmp"66⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\44B0.tmp"C:\Users\Admin\AppData\Local\Temp\44B0.tmp"67⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"68⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"69⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\4637.tmp"C:\Users\Admin\AppData\Local\Temp\4637.tmp"70⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\46D3.tmp"C:\Users\Admin\AppData\Local\Temp\46D3.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\4740.tmp"C:\Users\Admin\AppData\Local\Temp\4740.tmp"72⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\47CD.tmp"C:\Users\Admin\AppData\Local\Temp\47CD.tmp"73⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\484A.tmp"C:\Users\Admin\AppData\Local\Temp\484A.tmp"74⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\48C7.tmp"C:\Users\Admin\AppData\Local\Temp\48C7.tmp"75⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\4934.tmp"C:\Users\Admin\AppData\Local\Temp\4934.tmp"76⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\49B1.tmp"C:\Users\Admin\AppData\Local\Temp\49B1.tmp"77⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"78⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"79⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\4B86.tmp"C:\Users\Admin\AppData\Local\Temp\4B86.tmp"80⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"81⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\4C80.tmp"C:\Users\Admin\AppData\Local\Temp\4C80.tmp"82⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"83⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"84⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\4E36.tmp"C:\Users\Admin\AppData\Local\Temp\4E36.tmp"85⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"86⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\4F10.tmp"C:\Users\Admin\AppData\Local\Temp\4F10.tmp"87⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"88⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:264 -
C:\Users\Admin\AppData\Local\Temp\5087.tmp"C:\Users\Admin\AppData\Local\Temp\5087.tmp"90⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\5133.tmp"C:\Users\Admin\AppData\Local\Temp\5133.tmp"91⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\51A1.tmp"C:\Users\Admin\AppData\Local\Temp\51A1.tmp"92⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\522D.tmp"C:\Users\Admin\AppData\Local\Temp\522D.tmp"93⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\52C9.tmp"C:\Users\Admin\AppData\Local\Temp\52C9.tmp"94⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\5366.tmp"C:\Users\Admin\AppData\Local\Temp\5366.tmp"95⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\53F2.tmp"C:\Users\Admin\AppData\Local\Temp\53F2.tmp"96⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\547F.tmp"C:\Users\Admin\AppData\Local\Temp\547F.tmp"97⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\551B.tmp"C:\Users\Admin\AppData\Local\Temp\551B.tmp"98⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\5589.tmp"C:\Users\Admin\AppData\Local\Temp\5589.tmp"99⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5615.tmp"C:\Users\Admin\AppData\Local\Temp\5615.tmp"100⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\56A2.tmp"C:\Users\Admin\AppData\Local\Temp\56A2.tmp"101⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\572E.tmp"C:\Users\Admin\AppData\Local\Temp\572E.tmp"102⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\57BB.tmp"C:\Users\Admin\AppData\Local\Temp\57BB.tmp"103⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\5828.tmp"C:\Users\Admin\AppData\Local\Temp\5828.tmp"104⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\58B5.tmp"C:\Users\Admin\AppData\Local\Temp\58B5.tmp"105⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\5942.tmp"C:\Users\Admin\AppData\Local\Temp\5942.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\59FD.tmp"C:\Users\Admin\AppData\Local\Temp\59FD.tmp"107⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\5AF7.tmp"C:\Users\Admin\AppData\Local\Temp\5AF7.tmp"109⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\5B84.tmp"C:\Users\Admin\AppData\Local\Temp\5B84.tmp"110⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\5C01.tmp"C:\Users\Admin\AppData\Local\Temp\5C01.tmp"111⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"112⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\5CFB.tmp"C:\Users\Admin\AppData\Local\Temp\5CFB.tmp"113⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\5D78.tmp"C:\Users\Admin\AppData\Local\Temp\5D78.tmp"114⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\5DF5.tmp"C:\Users\Admin\AppData\Local\Temp\5DF5.tmp"115⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\5E72.tmp"C:\Users\Admin\AppData\Local\Temp\5E72.tmp"116⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"117⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"118⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\6037.tmp"C:\Users\Admin\AppData\Local\Temp\6037.tmp"119⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\60C4.tmp"C:\Users\Admin\AppData\Local\Temp\60C4.tmp"120⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\6141.tmp"C:\Users\Admin\AppData\Local\Temp\6141.tmp"121⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\61AE.tmp"C:\Users\Admin\AppData\Local\Temp\61AE.tmp"122⤵PID:2500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-