Analysis
- max time kernel
130s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 02:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_066220c34c2200196e4ae6582f2b537a_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_066220c34c2200196e4ae6582f2b537a_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-29_066220c34c2200196e4ae6582f2b537a_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260730-ch532abm2w
- SHA256 3ec35bafcd17f50be902bf53c9857b8a7c5932529241b8c94501d5056e587f32
- MD5 066220c34c2200196e4ae6582f2b537a
- SHA1 74e9a9e1a2b7f3e067a83819be142abee2e3e548
- SHA512 0de9bedfbe75e01cbf2b65fd2333f62fddd411fd4014bd47d7f60abdaffb7d1319ca9c6391ef87aee883d8268f19fc35696228a5ea5b12113a2f02be3144dd4f
- SSDEEP 12288:wU5rCOTeiDlvPb6wgrcsXCoz6XOPDOhTsHNZ+3/v+I9hUG2VA:wUQOJDlTpwCN8O9sHNGEA
- TLSH T1EAE4D02077D88632E5FB037859B5F6614D7EBD329722D6DF2B8416AE0971BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5544 ACB1.tmp 5528 ADEA.tmp 4552 AF41.tmp 1032 AFBE.tmp 1588 B02C.tmp 6284 B25E.tmp 6948 B3C6.tmp 6944 B53D.tmp 7152 B675.tmp 4952 B76F.tmp 6784 B8F6.tmp 940 BA6D.tmp 804 BB96.tmp 3260 BCAF.tmp 6148 BDF7.tmp 4708 BF4F.tmp 6604 C068.tmp 4584 C181.tmp 5820 C2BA.tmp 6520 C3E3.tmp 6348 C4BD.tmp 6508 C5F6.tmp 5656 C6FF.tmp 6436 C809.tmp 1048 C980.tmp 3264 CAC8.tmp 5744 CC10.tmp 5908 CD1A.tmp 2796 CE33.tmp 3040 CF8B.tmp 3400 D0C3.tmp 4760 D22B.tmp 3700 D306.tmp 5760 D3B1.tmp 4532 D4BB.tmp 1528 D586.tmp 3052 D651.tmp 3672 D6FD.tmp 6584 D7B9.tmp 6788 D855.tmp 4880 D8E2.tmp 1064 D98D.tmp 4148 DA68.tmp 5912 DB14.tmp 6416 DBDF.tmp 2848 DCBA.tmp 1144 DD66.tmp 1768 DE21.tmp 944 DE9E.tmp 3256 DF4A.tmp 4204 DFF6.tmp 5756 E073.tmp 5888 E0E0.tmp 5884 E16D.tmp 6876 E209.tmp 2464 E277.tmp 6864 E2F4.tmp 1244 E390.tmp 2480 E40D.tmp 6084 E49A.tmp 4056 E536.tmp 5752 E5C2.tmp 1224 E67E.tmp 3476 E6FB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 341C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6638.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6425.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 188A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EED6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 683C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E168.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E698.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2612.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9084.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C516.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 569D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 175D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8941.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F979.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ACA.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 5544 3576 2026-07-29_066220c34c2200196e4ae6582f2b537a_elex_mafia_stealc_tofsee.exe 89 PID 5544 wrote to memory of 5528 5544 ACB1.tmp 90 PID 5528 wrote to memory of 4552 5528 ADEA.tmp 91 PID 4552 wrote to memory of 1032 4552 AF41.tmp 92 PID 1032 wrote to memory of 1588 1032 AFBE.tmp 93 PID 1588 wrote to memory of 6284 1588 B02C.tmp 94 PID 6284 wrote to memory of 6948 6284 B25E.tmp 95 PID 6948 wrote to memory of 6944 6948 B3C6.tmp 96 PID 6944 wrote to memory of 7152 6944 B53D.tmp 97 PID 7152 wrote to memory of 4952 7152 B675.tmp 98 PID 4952 wrote to memory of 6784 4952 B76F.tmp 99 PID 6784 wrote to memory of 940 6784 B8F6.tmp 100 PID 940 wrote to memory of 804 940 BA6D.tmp 101 PID 804 wrote to memory of 3260 804 BB96.tmp 102 PID 3260 wrote to memory of 6148 3260 BCAF.tmp 103 PID 6148 wrote to memory of 4708 6148 BDF7.tmp 104 PID 4708 wrote to memory of 6604 4708 BF4F.tmp 105 PID 6604 wrote to memory of 4584 6604 C068.tmp 106 PID 4584 wrote to memory of 5820 4584 C181.tmp 107 PID 5820 wrote to memory of 6520 5820 C2BA.tmp 108 PID 6520 wrote to memory of 6348 6520 C3E3.tmp 109 PID 6348 wrote to memory of 6508 6348 C4BD.tmp 110 PID 6508 wrote to memory of 5656 6508 C5F6.tmp 111 PID 5656 wrote to memory of 6436 5656 C6FF.tmp 112 PID 6436 wrote to memory of 1048 6436 C809.tmp 113 PID 1048 wrote to memory of 3264 1048 C980.tmp 114 PID 3264 wrote to memory of 5744 3264 CAC8.tmp 115 PID 5744 wrote to memory of 5908 5744 CC10.tmp 116 PID 5908 wrote to memory of 2796 5908 CD1A.tmp 117 PID 2796 wrote to memory of 3040 2796 CE33.tmp 118 PID 3040 wrote to memory of 3400 3040 CF8B.tmp 119 PID 3400 wrote to memory of 4760 3400 D0C3.tmp 120 PID 4760 wrote to memory of 3700 4760 D22B.tmp 121 PID 3700 wrote to memory of 5760 3700 D306.tmp 122 PID 5760 wrote to memory of 4532 5760 D3B1.tmp 123 PID 4532 wrote to memory of 1528 4532 D4BB.tmp 124 PID 1528 wrote to memory of 3052 1528 D586.tmp 125 PID 3052 wrote to memory of 3672 3052 D651.tmp 126 PID 3672 wrote to memory of 6584 3672 D6FD.tmp 127 PID 6584 wrote to memory of 6788 6584 D7B9.tmp 128 PID 6788 wrote to memory of 4880 6788 D855.tmp 129 PID 4880 wrote to memory of 1064 4880 D8E2.tmp 130 PID 1064 wrote to memory of 4148 1064 D98D.tmp 131 PID 4148 wrote to memory of 5912 4148 DA68.tmp 132 PID 5912 wrote to memory of 6416 5912 DB14.tmp 133 PID 6416 wrote to memory of 2848 6416 DBDF.tmp 134 PID 2848 wrote to memory of 1144 2848 DCBA.tmp 135 PID 1144 wrote to memory of 1768 1144 DD66.tmp 136 PID 1768 wrote to memory of 944 1768 DE21.tmp 137 PID 944 wrote to memory of 3256 944 DE9E.tmp 138 PID 3256 wrote to memory of 4204 3256 DF4A.tmp 139 PID 4204 wrote to memory of 5756 4204 DFF6.tmp 140 PID 5756 wrote to memory of 5888 5756 E073.tmp 141 PID 5888 wrote to memory of 5884 5888 E0E0.tmp 142 PID 5884 wrote to memory of 6876 5884 E16D.tmp 143 PID 6876 wrote to memory of 2464 6876 E209.tmp 144 PID 2464 wrote to memory of 6864 2464 E277.tmp 145 PID 6864 wrote to memory of 1244 6864 E2F4.tmp 146 PID 1244 wrote to memory of 2480 1244 E390.tmp 147 PID 2480 wrote to memory of 6084 2480 E40D.tmp 148 PID 6084 wrote to memory of 4056 6084 E49A.tmp 149 PID 4056 wrote to memory of 5752 4056 E536.tmp 150 PID 5752 wrote to memory of 1224 5752 E5C2.tmp 151 PID 1224 wrote to memory of 3476 1224 E67E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_066220c34c2200196e4ae6582f2b537a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_066220c34c2200196e4ae6582f2b537a_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\ADEA.tmp"C:\Users\Admin\AppData\Local\Temp\ADEA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\AF41.tmp"C:\Users\Admin\AppData\Local\Temp\AF41.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\B02C.tmp"C:\Users\Admin\AppData\Local\Temp\B02C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6284 -
C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6948 -
C:\Users\Admin\AppData\Local\Temp\B53D.tmp"C:\Users\Admin\AppData\Local\Temp\B53D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6944 -
C:\Users\Admin\AppData\Local\Temp\B675.tmp"C:\Users\Admin\AppData\Local\Temp\B675.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7152 -
C:\Users\Admin\AppData\Local\Temp\B76F.tmp"C:\Users\Admin\AppData\Local\Temp\B76F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6784 -
C:\Users\Admin\AppData\Local\Temp\BA6D.tmp"C:\Users\Admin\AppData\Local\Temp\BA6D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\BB96.tmp"C:\Users\Admin\AppData\Local\Temp\BB96.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6148 -
C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\C068.tmp"C:\Users\Admin\AppData\Local\Temp\C068.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6604 -
C:\Users\Admin\AppData\Local\Temp\C181.tmp"C:\Users\Admin\AppData\Local\Temp\C181.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6520 -
C:\Users\Admin\AppData\Local\Temp\C4BD.tmp"C:\Users\Admin\AppData\Local\Temp\C4BD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6348 -
C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6508 -
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\C809.tmp"C:\Users\Admin\AppData\Local\Temp\C809.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6436 -
C:\Users\Admin\AppData\Local\Temp\C980.tmp"C:\Users\Admin\AppData\Local\Temp\C980.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\CC10.tmp"C:\Users\Admin\AppData\Local\Temp\CC10.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\CE33.tmp"C:\Users\Admin\AppData\Local\Temp\CE33.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\D22B.tmp"C:\Users\Admin\AppData\Local\Temp\D22B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\D306.tmp"C:\Users\Admin\AppData\Local\Temp\D306.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\D4BB.tmp"C:\Users\Admin\AppData\Local\Temp\D4BB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\D586.tmp"C:\Users\Admin\AppData\Local\Temp\D586.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\D651.tmp"C:\Users\Admin\AppData\Local\Temp\D651.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6584 -
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6788 -
C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\DA68.tmp"C:\Users\Admin\AppData\Local\Temp\DA68.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\DB14.tmp"C:\Users\Admin\AppData\Local\Temp\DB14.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\DBDF.tmp"C:\Users\Admin\AppData\Local\Temp\DBDF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6416 -
C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\DD66.tmp"C:\Users\Admin\AppData\Local\Temp\DD66.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\DE21.tmp"C:\Users\Admin\AppData\Local\Temp\DE21.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\E073.tmp"C:\Users\Admin\AppData\Local\Temp\E073.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\E16D.tmp"C:\Users\Admin\AppData\Local\Temp\E16D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\E209.tmp"C:\Users\Admin\AppData\Local\Temp\E209.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6876 -
C:\Users\Admin\AppData\Local\Temp\E277.tmp"C:\Users\Admin\AppData\Local\Temp\E277.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6864 -
C:\Users\Admin\AppData\Local\Temp\E390.tmp"C:\Users\Admin\AppData\Local\Temp\E390.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\E40D.tmp"C:\Users\Admin\AppData\Local\Temp\E40D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\E49A.tmp"C:\Users\Admin\AppData\Local\Temp\E49A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\E536.tmp"C:\Users\Admin\AppData\Local\Temp\E536.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\E67E.tmp"C:\Users\Admin\AppData\Local\Temp\E67E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"65⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"66⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\E843.tmp"C:\Users\Admin\AppData\Local\Temp\E843.tmp"67⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"68⤵PID:6292
-
C:\Users\Admin\AppData\Local\Temp\E95C.tmp"C:\Users\Admin\AppData\Local\Temp\E95C.tmp"69⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\EA08.tmp"C:\Users\Admin\AppData\Local\Temp\EA08.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:6768 -
C:\Users\Admin\AppData\Local\Temp\EAA4.tmp"C:\Users\Admin\AppData\Local\Temp\EAA4.tmp"71⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\EB21.tmp"C:\Users\Admin\AppData\Local\Temp\EB21.tmp"72⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"73⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"74⤵PID:6924
-
C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"75⤵PID:6352
-
C:\Users\Admin\AppData\Local\Temp\ED44.tmp"C:\Users\Admin\AppData\Local\Temp\ED44.tmp"76⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"77⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"78⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"79⤵PID:6912
-
C:\Users\Admin\AppData\Local\Temp\EF58.tmp"C:\Users\Admin\AppData\Local\Temp\EF58.tmp"80⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\EFF4.tmp"C:\Users\Admin\AppData\Local\Temp\EFF4.tmp"81⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\F080.tmp"C:\Users\Admin\AppData\Local\Temp\F080.tmp"82⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\F0FD.tmp"C:\Users\Admin\AppData\Local\Temp\F0FD.tmp"83⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\F19A.tmp"C:\Users\Admin\AppData\Local\Temp\F19A.tmp"84⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\F217.tmp"C:\Users\Admin\AppData\Local\Temp\F217.tmp"85⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\F284.tmp"C:\Users\Admin\AppData\Local\Temp\F284.tmp"86⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\F330.tmp"C:\Users\Admin\AppData\Local\Temp\F330.tmp"87⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"88⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\F459.tmp"C:\Users\Admin\AppData\Local\Temp\F459.tmp"89⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\F4E5.tmp"C:\Users\Admin\AppData\Local\Temp\F4E5.tmp"90⤵PID:6920
-
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"91⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"92⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\F66C.tmp"C:\Users\Admin\AppData\Local\Temp\F66C.tmp"93⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"94⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\F785.tmp"C:\Users\Admin\AppData\Local\Temp\F785.tmp"95⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\F822.tmp"C:\Users\Admin\AppData\Local\Temp\F822.tmp"96⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"97⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\F979.tmp"C:\Users\Admin\AppData\Local\Temp\F979.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\FA06.tmp"C:\Users\Admin\AppData\Local\Temp\FA06.tmp"99⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"100⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"101⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\FB9C.tmp"C:\Users\Admin\AppData\Local\Temp\FB9C.tmp"102⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\FC38.tmp"C:\Users\Admin\AppData\Local\Temp\FC38.tmp"103⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"104⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\FD61.tmp"C:\Users\Admin\AppData\Local\Temp\FD61.tmp"105⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"106⤵PID:6716
-
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"107⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"108⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"109⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\40.tmp"C:\Users\Admin\AppData\Local\Temp\40.tmp"110⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"111⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\178.tmp"C:\Users\Admin\AppData\Local\Temp\178.tmp"112⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\1F5.tmp"C:\Users\Admin\AppData\Local\Temp\1F5.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:6572 -
C:\Users\Admin\AppData\Local\Temp\282.tmp"C:\Users\Admin\AppData\Local\Temp\282.tmp"114⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\31E.tmp"C:\Users\Admin\AppData\Local\Temp\31E.tmp"115⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\39B.tmp"C:\Users\Admin\AppData\Local\Temp\39B.tmp"116⤵PID:6156
-
C:\Users\Admin\AppData\Local\Temp\418.tmp"C:\Users\Admin\AppData\Local\Temp\418.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\4A5.tmp"C:\Users\Admin\AppData\Local\Temp\4A5.tmp"118⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"119⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\5CE.tmp"C:\Users\Admin\AppData\Local\Temp\5CE.tmp"120⤵PID:6560
-
C:\Users\Admin\AppData\Local\Temp\66A.tmp"C:\Users\Admin\AppData\Local\Temp\66A.tmp"121⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\706.tmp"C:\Users\Admin\AppData\Local\Temp\706.tmp"122⤵PID:2992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-