Analysis
- max time kernel
114s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 02:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_0d1f90606a7952935798a63a4627907f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_0d1f90606a7952935798a63a4627907f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-29_0d1f90606a7952935798a63a4627907f_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260730-chjvssad33
- SHA256 ef03c7596a956bb303d29864db1d6b518e75c96e8f211edab827d84868932e1e
- MD5 0d1f90606a7952935798a63a4627907f
- SHA1 2a4a612d5a91904a957615365b343dc3b874ffb7
- SHA512 06db967d145627bbc1ca9ea04be06d0f8b6de02c20091b128101a417b991af23762f81c0e93972810f44d4dd732fd20b3d44e656aafe1bb95a6a4ee8f364fc64
- SSDEEP 12288:NU5rCOTeijNio6UF5X0yXgEHgsd0Z6SyRf+TZwlH:NUQOJjNiFGXRXzHgsiRAf+TSlH
- TLSH T164B4F115B645C133E19202750AEAEBB25A3BBD31472664C33BD4A37E2FB16E1D739306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1304 66F.tmp 5424 71A.tmp 4144 7C6.tmp 1508 882.tmp 4652 8FF.tmp 5256 9CA.tmp 2188 A95.tmp 2684 B51.tmp 1736 BFC.tmp 5080 D45.tmp 4996 DF0.tmp 1316 EAC.tmp 4440 F58.tmp 5740 FF4.tmp 2856 10B0.tmp 5964 116B.tmp 2328 1236.tmp 468 12E2.tmp 5504 137E.tmp 1256 140B.tmp 3464 14E6.tmp 4348 15A1.tmp 3840 16AB.tmp 3972 1766.tmp 3424 1822.tmp 6096 191C.tmp 5284 19C8.tmp 552 1A45.tmp 1900 1AE1.tmp 2804 1B5E.tmp 3848 1C48.tmp 5928 1CF4.tmp 4824 1D81.tmp 5376 1E0D.tmp 4644 1E8A.tmp 6000 1F17.tmp 2960 1F94.tmp 2748 2021.tmp 3212 20CD.tmp 1760 2159.tmp 3240 21C7.tmp 4308 2234.tmp 1732 22C1.tmp 4956 234D.tmp 2572 23BB.tmp 1880 2447.tmp 5132 24D4.tmp 2108 2541.tmp 2392 25AF.tmp 4960 262C.tmp 5976 26B8.tmp 3680 2726.tmp 5832 27A3.tmp 3480 282F.tmp 3964 28AC.tmp 4288 2939.tmp 3224 29E5.tmp 1204 2A81.tmp 5892 2B1D.tmp 4500 2B8B.tmp 3104 2C08.tmp 4760 2C75.tmp 4152 2D11.tmp 4336 2D9E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9348.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F61E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A22D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A932.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3743.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8202.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4046.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_0d1f90606a7952935798a63a4627907f_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B82B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 498D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAE3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1208 wrote to memory of 1304 1208 2026-07-29_0d1f90606a7952935798a63a4627907f_elex_mafia_stealc_tofsee.exe 89 PID 1304 wrote to memory of 5424 1304 66F.tmp 90 PID 5424 wrote to memory of 4144 5424 71A.tmp 91 PID 4144 wrote to memory of 1508 4144 7C6.tmp 92 PID 1508 wrote to memory of 4652 1508 882.tmp 93 PID 4652 wrote to memory of 5256 4652 8FF.tmp 94 PID 5256 wrote to memory of 2188 5256 9CA.tmp 95 PID 2188 wrote to memory of 2684 2188 A95.tmp 96 PID 2684 wrote to memory of 1736 2684 B51.tmp 97 PID 1736 wrote to memory of 5080 1736 BFC.tmp 98 PID 5080 wrote to memory of 4996 5080 D45.tmp 99 PID 4996 wrote to memory of 1316 4996 DF0.tmp 100 PID 1316 wrote to memory of 4440 1316 EAC.tmp 101 PID 4440 wrote to memory of 5740 4440 F58.tmp 102 PID 5740 wrote to memory of 2856 5740 FF4.tmp 103 PID 2856 wrote to memory of 5964 2856 10B0.tmp 104 PID 5964 wrote to memory of 2328 5964 116B.tmp 105 PID 2328 wrote to memory of 468 2328 1236.tmp 106 PID 468 wrote to memory of 5504 468 12E2.tmp 107 PID 5504 wrote to memory of 1256 5504 137E.tmp 108 PID 1256 wrote to memory of 3464 1256 140B.tmp 109 PID 3464 wrote to memory of 4348 3464 14E6.tmp 110 PID 4348 wrote to memory of 3840 4348 15A1.tmp 111 PID 3840 wrote to memory of 3972 3840 16AB.tmp 112 PID 3972 wrote to memory of 3424 3972 1766.tmp 113 PID 3424 wrote to memory of 6096 3424 1822.tmp 114 PID 6096 wrote to memory of 5284 6096 191C.tmp 115 PID 5284 wrote to memory of 552 5284 19C8.tmp 116 PID 552 wrote to memory of 1900 552 1A45.tmp 117 PID 1900 wrote to memory of 2804 1900 1AE1.tmp 118 PID 2804 wrote to memory of 3848 2804 1B5E.tmp 119 PID 3848 wrote to memory of 5928 3848 1C48.tmp 120 PID 5928 wrote to memory of 4824 5928 1CF4.tmp 121 PID 4824 wrote to memory of 5376 4824 1D81.tmp 122 PID 5376 wrote to memory of 4644 5376 1E0D.tmp 123 PID 4644 wrote to memory of 6000 4644 1E8A.tmp 124 PID 6000 wrote to memory of 2960 6000 1F17.tmp 125 PID 2960 wrote to memory of 2748 2960 1F94.tmp 126 PID 2748 wrote to memory of 3212 2748 2021.tmp 127 PID 3212 wrote to memory of 1760 3212 20CD.tmp 128 PID 1760 wrote to memory of 3240 1760 2159.tmp 129 PID 3240 wrote to memory of 4308 3240 21C7.tmp 130 PID 4308 wrote to memory of 1732 4308 2234.tmp 131 PID 1732 wrote to memory of 4956 1732 22C1.tmp 132 PID 4956 wrote to memory of 2572 4956 234D.tmp 133 PID 2572 wrote to memory of 1880 2572 23BB.tmp 134 PID 1880 wrote to memory of 5132 1880 2447.tmp 135 PID 5132 wrote to memory of 2108 5132 24D4.tmp 136 PID 2108 wrote to memory of 2392 2108 2541.tmp 137 PID 2392 wrote to memory of 4960 2392 25AF.tmp 138 PID 4960 wrote to memory of 5976 4960 262C.tmp 139 PID 5976 wrote to memory of 3680 5976 26B8.tmp 140 PID 3680 wrote to memory of 5832 3680 2726.tmp 141 PID 5832 wrote to memory of 3480 5832 27A3.tmp 142 PID 3480 wrote to memory of 3964 3480 282F.tmp 143 PID 3964 wrote to memory of 4288 3964 28AC.tmp 144 PID 4288 wrote to memory of 3224 4288 2939.tmp 145 PID 3224 wrote to memory of 1204 3224 29E5.tmp 146 PID 1204 wrote to memory of 5892 1204 2A81.tmp 147 PID 5892 wrote to memory of 4500 5892 2B1D.tmp 148 PID 4500 wrote to memory of 3104 4500 2B8B.tmp 149 PID 3104 wrote to memory of 4760 3104 2C08.tmp 150 PID 4760 wrote to memory of 4152 4760 2C75.tmp 151 PID 4152 wrote to memory of 4336 4152 2D11.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_0d1f90606a7952935798a63a4627907f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_0d1f90606a7952935798a63a4627907f_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\66F.tmp"C:\Users\Admin\AppData\Local\Temp\66F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\71A.tmp"C:\Users\Admin\AppData\Local\Temp\71A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\7C6.tmp"C:\Users\Admin\AppData\Local\Temp\7C6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\882.tmp"C:\Users\Admin\AppData\Local\Temp\882.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\8FF.tmp"C:\Users\Admin\AppData\Local\Temp\8FF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\9CA.tmp"C:\Users\Admin\AppData\Local\Temp\9CA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\A95.tmp"C:\Users\Admin\AppData\Local\Temp\A95.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\B51.tmp"C:\Users\Admin\AppData\Local\Temp\B51.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\BFC.tmp"C:\Users\Admin\AppData\Local\Temp\BFC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\D45.tmp"C:\Users\Admin\AppData\Local\Temp\D45.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\DF0.tmp"C:\Users\Admin\AppData\Local\Temp\DF0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\EAC.tmp"C:\Users\Admin\AppData\Local\Temp\EAC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\F58.tmp"C:\Users\Admin\AppData\Local\Temp\F58.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\FF4.tmp"C:\Users\Admin\AppData\Local\Temp\FF4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\116B.tmp"C:\Users\Admin\AppData\Local\Temp\116B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\1236.tmp"C:\Users\Admin\AppData\Local\Temp\1236.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\12E2.tmp"C:\Users\Admin\AppData\Local\Temp\12E2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\137E.tmp"C:\Users\Admin\AppData\Local\Temp\137E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\140B.tmp"C:\Users\Admin\AppData\Local\Temp\140B.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\14E6.tmp"C:\Users\Admin\AppData\Local\Temp\14E6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\16AB.tmp"C:\Users\Admin\AppData\Local\Temp\16AB.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\1766.tmp"C:\Users\Admin\AppData\Local\Temp\1766.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\1AE1.tmp"C:\Users\Admin\AppData\Local\Temp\1AE1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\1C48.tmp"C:\Users\Admin\AppData\Local\Temp\1C48.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\1D81.tmp"C:\Users\Admin\AppData\Local\Temp\1D81.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\1F17.tmp"C:\Users\Admin\AppData\Local\Temp\1F17.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\1F94.tmp"C:\Users\Admin\AppData\Local\Temp\1F94.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\2159.tmp"C:\Users\Admin\AppData\Local\Temp\2159.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\2234.tmp"C:\Users\Admin\AppData\Local\Temp\2234.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\22C1.tmp"C:\Users\Admin\AppData\Local\Temp\22C1.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\234D.tmp"C:\Users\Admin\AppData\Local\Temp\234D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\23BB.tmp"C:\Users\Admin\AppData\Local\Temp\23BB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\2447.tmp"C:\Users\Admin\AppData\Local\Temp\2447.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\24D4.tmp"C:\Users\Admin\AppData\Local\Temp\24D4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\2541.tmp"C:\Users\Admin\AppData\Local\Temp\2541.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\25AF.tmp"C:\Users\Admin\AppData\Local\Temp\25AF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\262C.tmp"C:\Users\Admin\AppData\Local\Temp\262C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\26B8.tmp"C:\Users\Admin\AppData\Local\Temp\26B8.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\2726.tmp"C:\Users\Admin\AppData\Local\Temp\2726.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\27A3.tmp"C:\Users\Admin\AppData\Local\Temp\27A3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\282F.tmp"C:\Users\Admin\AppData\Local\Temp\282F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\28AC.tmp"C:\Users\Admin\AppData\Local\Temp\28AC.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\2939.tmp"C:\Users\Admin\AppData\Local\Temp\2939.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\29E5.tmp"C:\Users\Admin\AppData\Local\Temp\29E5.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\2A81.tmp"C:\Users\Admin\AppData\Local\Temp\2A81.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\2C75.tmp"C:\Users\Admin\AppData\Local\Temp\2C75.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\2D11.tmp"C:\Users\Admin\AppData\Local\Temp\2D11.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"65⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"66⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"67⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\2F44.tmp"C:\Users\Admin\AppData\Local\Temp\2F44.tmp"68⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"69⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\304D.tmp"C:\Users\Admin\AppData\Local\Temp\304D.tmp"70⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\30EA.tmp"C:\Users\Admin\AppData\Local\Temp\30EA.tmp"71⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\3195.tmp"C:\Users\Admin\AppData\Local\Temp\3195.tmp"72⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3203.tmp"C:\Users\Admin\AppData\Local\Temp\3203.tmp"73⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\328F.tmp"C:\Users\Admin\AppData\Local\Temp\328F.tmp"74⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"75⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\33D8.tmp"C:\Users\Admin\AppData\Local\Temp\33D8.tmp"76⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\3464.tmp"C:\Users\Admin\AppData\Local\Temp\3464.tmp"77⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\34F1.tmp"C:\Users\Admin\AppData\Local\Temp\34F1.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\359D.tmp"C:\Users\Admin\AppData\Local\Temp\359D.tmp"79⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\3629.tmp"C:\Users\Admin\AppData\Local\Temp\3629.tmp"80⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\36B6.tmp"C:\Users\Admin\AppData\Local\Temp\36B6.tmp"81⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\3743.tmp"C:\Users\Admin\AppData\Local\Temp\3743.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\37DF.tmp"C:\Users\Admin\AppData\Local\Temp\37DF.tmp"83⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\387B.tmp"C:\Users\Admin\AppData\Local\Temp\387B.tmp"84⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\38E8.tmp"C:\Users\Admin\AppData\Local\Temp\38E8.tmp"85⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\3985.tmp"C:\Users\Admin\AppData\Local\Temp\3985.tmp"86⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\3A11.tmp"C:\Users\Admin\AppData\Local\Temp\3A11.tmp"87⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"88⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"89⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"90⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\3C53.tmp"C:\Users\Admin\AppData\Local\Temp\3C53.tmp"91⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"92⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"93⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"94⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\3E76.tmp"C:\Users\Admin\AppData\Local\Temp\3E76.tmp"95⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"96⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"97⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\403B.tmp"C:\Users\Admin\AppData\Local\Temp\403B.tmp"98⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\40D8.tmp"C:\Users\Admin\AppData\Local\Temp\40D8.tmp"99⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\4145.tmp"C:\Users\Admin\AppData\Local\Temp\4145.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:628 -
C:\Users\Admin\AppData\Local\Temp\41E1.tmp"C:\Users\Admin\AppData\Local\Temp\41E1.tmp"101⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\425E.tmp"C:\Users\Admin\AppData\Local\Temp\425E.tmp"102⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\42EB.tmp"C:\Users\Admin\AppData\Local\Temp\42EB.tmp"103⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\4358.tmp"C:\Users\Admin\AppData\Local\Temp\4358.tmp"104⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\43F5.tmp"C:\Users\Admin\AppData\Local\Temp\43F5.tmp"105⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\4472.tmp"C:\Users\Admin\AppData\Local\Temp\4472.tmp"106⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\450E.tmp"C:\Users\Admin\AppData\Local\Temp\450E.tmp"107⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\45C9.tmp"C:\Users\Admin\AppData\Local\Temp\45C9.tmp"108⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\4646.tmp"C:\Users\Admin\AppData\Local\Temp\4646.tmp"109⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\46B4.tmp"C:\Users\Admin\AppData\Local\Temp\46B4.tmp"110⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\4750.tmp"C:\Users\Admin\AppData\Local\Temp\4750.tmp"111⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\47EC.tmp"C:\Users\Admin\AppData\Local\Temp\47EC.tmp"112⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\4869.tmp"C:\Users\Admin\AppData\Local\Temp\4869.tmp"113⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\4905.tmp"C:\Users\Admin\AppData\Local\Temp\4905.tmp"114⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\49B1.tmp"C:\Users\Admin\AppData\Local\Temp\49B1.tmp"115⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"116⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\4ACB.tmp"C:\Users\Admin\AppData\Local\Temp\4ACB.tmp"117⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\4B57.tmp"C:\Users\Admin\AppData\Local\Temp\4B57.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:564 -
C:\Users\Admin\AppData\Local\Temp\4C22.tmp"C:\Users\Admin\AppData\Local\Temp\4C22.tmp"119⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"120⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"121⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"122⤵PID:4104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-