Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 12:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_b0e8329e99abcfcb6339d92e5fc77a73_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_b0e8329e99abcfcb6339d92e5fc77a73_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-29_b0e8329e99abcfcb6339d92e5fc77a73_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260729-pca2xsvyft
- SHA256 bc4b67b4dfe6fc69fbadc779208a843a02dc2ee1b00effa46551e49185c5303c
- MD5 b0e8329e99abcfcb6339d92e5fc77a73
- SHA1 b3f1fbd089ebfbbd4b54884b986fa73d2da43be4
- SHA512 1e14959eaf1e939cfb64a7523b2227f3b383207851cac0fb4296b97ba84953c75b9d9610d86a6a4bf194c069325353aa4621b781fcc14a4d04e445fe66bc13bd
- SSDEEP 12288:NU5rCOTeijKKKty/0hnfBJeV7igWZ3vcbYTZwlH:NUQOJjKKKd4sZ/PTSlH
- TLSH T173B4F026BA81C033E29202314AD6DBB2693FBD35572654C73B84676E6FB12E2D375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5980 9A52.tmp 2184 9B6B.tmp 5368 9C07.tmp 5436 9CE2.tmp 4900 9DAD.tmp 4552 9EF5.tmp 2880 9FA1.tmp 3036 A04D.tmp 1272 A128.tmp 1896 A1B5.tmp 2496 A280.tmp 3496 A31C.tmp 264 A3B8.tmp 1264 A435.tmp 1424 A4E1.tmp 4936 A57D.tmp 2304 A629.tmp 3032 A6D5.tmp 3788 A7DF.tmp 3556 A8C9.tmp 1564 A985.tmp 2008 AA30.tmp 6132 AAEC.tmp 2396 ABC7.tmp 5956 AC92.tmp 5984 AD4D.tmp 4476 ADEA.tmp 2216 AEF3.tmp 1572 AFAF.tmp 5060 B07A.tmp 1300 B164.tmp 5440 B220.tmp 4752 B2CC.tmp 2352 B368.tmp 4120 B3E5.tmp 3196 B452.tmp 4428 B4CF.tmp 2648 B54C.tmp 1600 B5BA.tmp 4768 B637.tmp 5324 B6B4.tmp 1712 B750.tmp 3272 B7CD.tmp 3360 B84A.tmp 5456 B8F6.tmp 5968 B982.tmp 5812 B9FF.tmp 5032 BA8C.tmp 1732 BAEA.tmp 2900 BB67.tmp 4140 BBD4.tmp 1700 BC61.tmp 5408 BD1C.tmp 5600 BD8A.tmp 4612 BE16.tmp 3960 BEA3.tmp 1044 BF10.tmp 5424 BFAC.tmp 3276 C039.tmp 3484 C0A6.tmp 944 C143.tmp 5320 C1EF.tmp 3464 C26C.tmp 6000 C317.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A985.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F64D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 967.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 616B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 312E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D97E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 597B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B835.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C63F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3516.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B54C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3236 wrote to memory of 5980 3236 2026-07-29_b0e8329e99abcfcb6339d92e5fc77a73_elex_mafia_stealc_tofsee.exe 88 PID 5980 wrote to memory of 2184 5980 9A52.tmp 89 PID 2184 wrote to memory of 5368 2184 9B6B.tmp 90 PID 5368 wrote to memory of 5436 5368 9C07.tmp 91 PID 5436 wrote to memory of 4900 5436 9CE2.tmp 92 PID 4900 wrote to memory of 4552 4900 9DAD.tmp 93 PID 4552 wrote to memory of 2880 4552 9EF5.tmp 94 PID 2880 wrote to memory of 3036 2880 9FA1.tmp 95 PID 3036 wrote to memory of 1272 3036 A04D.tmp 96 PID 1272 wrote to memory of 1896 1272 A128.tmp 97 PID 1896 wrote to memory of 2496 1896 A1B5.tmp 98 PID 2496 wrote to memory of 3496 2496 A280.tmp 99 PID 3496 wrote to memory of 264 3496 A31C.tmp 100 PID 264 wrote to memory of 1264 264 A3B8.tmp 101 PID 1264 wrote to memory of 1424 1264 A435.tmp 102 PID 1424 wrote to memory of 4936 1424 A4E1.tmp 103 PID 4936 wrote to memory of 2304 4936 A57D.tmp 104 PID 2304 wrote to memory of 3032 2304 A629.tmp 105 PID 3032 wrote to memory of 3788 3032 A6D5.tmp 106 PID 3788 wrote to memory of 3556 3788 A7DF.tmp 107 PID 3556 wrote to memory of 1564 3556 A8C9.tmp 108 PID 1564 wrote to memory of 2008 1564 A985.tmp 109 PID 2008 wrote to memory of 6132 2008 AA30.tmp 110 PID 6132 wrote to memory of 2396 6132 AAEC.tmp 111 PID 2396 wrote to memory of 5956 2396 ABC7.tmp 112 PID 5956 wrote to memory of 5984 5956 AC92.tmp 113 PID 5984 wrote to memory of 4476 5984 AD4D.tmp 114 PID 4476 wrote to memory of 2216 4476 ADEA.tmp 115 PID 2216 wrote to memory of 1572 2216 AEF3.tmp 116 PID 1572 wrote to memory of 5060 1572 AFAF.tmp 117 PID 5060 wrote to memory of 1300 5060 B07A.tmp 118 PID 1300 wrote to memory of 5440 1300 B164.tmp 119 PID 5440 wrote to memory of 4752 5440 B220.tmp 120 PID 4752 wrote to memory of 2352 4752 B2CC.tmp 121 PID 2352 wrote to memory of 4120 2352 B368.tmp 122 PID 4120 wrote to memory of 3196 4120 B3E5.tmp 123 PID 3196 wrote to memory of 4428 3196 B452.tmp 124 PID 4428 wrote to memory of 2648 4428 B4CF.tmp 125 PID 2648 wrote to memory of 1600 2648 B54C.tmp 126 PID 1600 wrote to memory of 4768 1600 B5BA.tmp 127 PID 4768 wrote to memory of 5324 4768 B637.tmp 128 PID 5324 wrote to memory of 1712 5324 B6B4.tmp 129 PID 1712 wrote to memory of 3272 1712 B750.tmp 130 PID 3272 wrote to memory of 3360 3272 B7CD.tmp 131 PID 3360 wrote to memory of 5456 3360 B84A.tmp 132 PID 5456 wrote to memory of 5968 5456 B8F6.tmp 133 PID 5968 wrote to memory of 5812 5968 B982.tmp 134 PID 5812 wrote to memory of 5032 5812 B9FF.tmp 135 PID 5032 wrote to memory of 1732 5032 BA8C.tmp 136 PID 1732 wrote to memory of 2900 1732 BAEA.tmp 137 PID 2900 wrote to memory of 4140 2900 BB67.tmp 138 PID 4140 wrote to memory of 1700 4140 BBD4.tmp 139 PID 1700 wrote to memory of 5408 1700 BC61.tmp 140 PID 5408 wrote to memory of 5600 5408 BD1C.tmp 141 PID 5600 wrote to memory of 4612 5600 BD8A.tmp 142 PID 4612 wrote to memory of 3960 4612 BE16.tmp 143 PID 3960 wrote to memory of 1044 3960 BEA3.tmp 144 PID 1044 wrote to memory of 5424 1044 BF10.tmp 145 PID 5424 wrote to memory of 3276 5424 BFAC.tmp 146 PID 3276 wrote to memory of 3484 3276 C039.tmp 147 PID 3484 wrote to memory of 944 3484 C0A6.tmp 148 PID 944 wrote to memory of 5320 944 C143.tmp 149 PID 5320 wrote to memory of 3464 5320 C1EF.tmp 150 PID 3464 wrote to memory of 6000 3464 C26C.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_b0e8329e99abcfcb6339d92e5fc77a73_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_b0e8329e99abcfcb6339d92e5fc77a73_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\9A52.tmp"C:\Users\Admin\AppData\Local\Temp\9A52.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\9C07.tmp"C:\Users\Admin\AppData\Local\Temp\9C07.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\A04D.tmp"C:\Users\Admin\AppData\Local\Temp\A04D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\A128.tmp"C:\Users\Admin\AppData\Local\Temp\A128.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\A1B5.tmp"C:\Users\Admin\AppData\Local\Temp\A1B5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\A280.tmp"C:\Users\Admin\AppData\Local\Temp\A280.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\A31C.tmp"C:\Users\Admin\AppData\Local\Temp\A31C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\A435.tmp"C:\Users\Admin\AppData\Local\Temp\A435.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\A57D.tmp"C:\Users\Admin\AppData\Local\Temp\A57D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\A629.tmp"C:\Users\Admin\AppData\Local\Temp\A629.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\A985.tmp"C:\Users\Admin\AppData\Local\Temp\A985.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\AA30.tmp"C:\Users\Admin\AppData\Local\Temp\AA30.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\ABC7.tmp"C:\Users\Admin\AppData\Local\Temp\ABC7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\AC92.tmp"C:\Users\Admin\AppData\Local\Temp\AC92.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\ADEA.tmp"C:\Users\Admin\AppData\Local\Temp\ADEA.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\B07A.tmp"C:\Users\Admin\AppData\Local\Temp\B07A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\B164.tmp"C:\Users\Admin\AppData\Local\Temp\B164.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\B2CC.tmp"C:\Users\Admin\AppData\Local\Temp\B2CC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\B368.tmp"C:\Users\Admin\AppData\Local\Temp\B368.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\B452.tmp"C:\Users\Admin\AppData\Local\Temp\B452.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\B54C.tmp"C:\Users\Admin\AppData\Local\Temp\B54C.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\B637.tmp"C:\Users\Admin\AppData\Local\Temp\B637.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\B750.tmp"C:\Users\Admin\AppData\Local\Temp\B750.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\B84A.tmp"C:\Users\Admin\AppData\Local\Temp\B84A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\B982.tmp"C:\Users\Admin\AppData\Local\Temp\B982.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\BB67.tmp"C:\Users\Admin\AppData\Local\Temp\BB67.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\BC61.tmp"C:\Users\Admin\AppData\Local\Temp\BC61.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\BE16.tmp"C:\Users\Admin\AppData\Local\Temp\BE16.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\BF10.tmp"C:\Users\Admin\AppData\Local\Temp\BF10.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\BFAC.tmp"C:\Users\Admin\AppData\Local\Temp\BFAC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\C039.tmp"C:\Users\Admin\AppData\Local\Temp\C039.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\C143.tmp"C:\Users\Admin\AppData\Local\Temp\C143.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\C1EF.tmp"C:\Users\Admin\AppData\Local\Temp\C1EF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\C26C.tmp"C:\Users\Admin\AppData\Local\Temp\C26C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\C317.tmp"C:\Users\Admin\AppData\Local\Temp\C317.tmp"65⤵
- Executes dropped EXE
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\C385.tmp"C:\Users\Admin\AppData\Local\Temp\C385.tmp"66⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\C421.tmp"C:\Users\Admin\AppData\Local\Temp\C421.tmp"67⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\C48E.tmp"C:\Users\Admin\AppData\Local\Temp\C48E.tmp"68⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\C50B.tmp"C:\Users\Admin\AppData\Local\Temp\C50B.tmp"69⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\C588.tmp"C:\Users\Admin\AppData\Local\Temp\C588.tmp"70⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\C615.tmp"C:\Users\Admin\AppData\Local\Temp\C615.tmp"71⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"72⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\C73E.tmp"C:\Users\Admin\AppData\Local\Temp\C73E.tmp"73⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"74⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\C886.tmp"C:\Users\Admin\AppData\Local\Temp\C886.tmp"75⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\C913.tmp"C:\Users\Admin\AppData\Local\Temp\C913.tmp"76⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\C990.tmp"C:\Users\Admin\AppData\Local\Temp\C990.tmp"77⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"78⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"79⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\CB07.tmp"C:\Users\Admin\AppData\Local\Temp\CB07.tmp"80⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\CB84.tmp"C:\Users\Admin\AppData\Local\Temp\CB84.tmp"81⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\CC10.tmp"C:\Users\Admin\AppData\Local\Temp\CC10.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"83⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"84⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\CD97.tmp"C:\Users\Admin\AppData\Local\Temp\CD97.tmp"85⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\CE04.tmp"C:\Users\Admin\AppData\Local\Temp\CE04.tmp"86⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\CE91.tmp"C:\Users\Admin\AppData\Local\Temp\CE91.tmp"87⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"88⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"89⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\D056.tmp"C:\Users\Admin\AppData\Local\Temp\D056.tmp"90⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\D102.tmp"C:\Users\Admin\AppData\Local\Temp\D102.tmp"91⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\D18F.tmp"C:\Users\Admin\AppData\Local\Temp\D18F.tmp"92⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\D21B.tmp"C:\Users\Admin\AppData\Local\Temp\D21B.tmp"93⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\D298.tmp"C:\Users\Admin\AppData\Local\Temp\D298.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\D306.tmp"C:\Users\Admin\AppData\Local\Temp\D306.tmp"95⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"96⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\D40F.tmp"C:\Users\Admin\AppData\Local\Temp\D40F.tmp"97⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\D48C.tmp"C:\Users\Admin\AppData\Local\Temp\D48C.tmp"98⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\D509.tmp"C:\Users\Admin\AppData\Local\Temp\D509.tmp"99⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\D596.tmp"C:\Users\Admin\AppData\Local\Temp\D596.tmp"100⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\D632.tmp"C:\Users\Admin\AppData\Local\Temp\D632.tmp"101⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"102⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\D73C.tmp"C:\Users\Admin\AppData\Local\Temp\D73C.tmp"103⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"104⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"105⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"106⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\D97E.tmp"C:\Users\Admin\AppData\Local\Temp\D97E.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"108⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\DA87.tmp"C:\Users\Admin\AppData\Local\Temp\DA87.tmp"109⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\DB24.tmp"C:\Users\Admin\AppData\Local\Temp\DB24.tmp"110⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"111⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\DC3D.tmp"C:\Users\Admin\AppData\Local\Temp\DC3D.tmp"112⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"113⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\DD37.tmp"C:\Users\Admin\AppData\Local\Temp\DD37.tmp"114⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"115⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\DE31.tmp"C:\Users\Admin\AppData\Local\Temp\DE31.tmp"116⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\DEAE.tmp"C:\Users\Admin\AppData\Local\Temp\DEAE.tmp"117⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"118⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"119⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\E044.tmp"C:\Users\Admin\AppData\Local\Temp\E044.tmp"120⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\E0A2.tmp"C:\Users\Admin\AppData\Local\Temp\E0A2.tmp"121⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\E13E.tmp"C:\Users\Admin\AppData\Local\Temp\E13E.tmp"122⤵PID:3448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-