Analysis
- max time kernel
119s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 15:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_abe639b3bb386332ff751239c72e700d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_abe639b3bb386332ff751239c72e700d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-30_abe639b3bb386332ff751239c72e700d_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260730-sgxchabd66
- SHA256 0a40bd47025efe0d4407b103dab2e5b30c6d4787adecdbb26e2dd657928b5a34
- MD5 abe639b3bb386332ff751239c72e700d
- SHA1 f2ae67ddca2f865a7fafaa2c47395a6ebc4a6624
- SHA512 ca5c9976ee0295e19e550a5b2be9f55f13ea95bb5c882478452d92cd49c938d3257e617b3c89d4e5fa60a5beaf4c26b462192b3b12fbd390128b13536b0aa973
- SSDEEP 12288:wU5rCOTeiDLKPZgNDG7vJvtYHTOuXgZSXtYNZ+3/v+I9hUG2VA:wUQOJDL+iM7VezzwZS9YNGEA
- TLSH T1C9E4D02173D8C632E5FB037859B5E761497EBD266712D6CF2F8016AE19B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 852 FE7F.tmp 1976 FF99.tmp 5756 A2.tmp 4384 1AC.tmp 1568 2B5.tmp 2748 371.tmp 1484 3FE.tmp 2576 546.tmp 5728 620.tmp 2176 69D.tmp 1508 7D6.tmp 2644 90E.tmp 3416 A95.tmp 1460 B7F.tmp 4444 C6A.tmp 5140 D64.tmp 472 E9C.tmp 404 F77.tmp 2560 1061.tmp 4172 11D8.tmp 940 12B3.tmp 5968 13AD.tmp 5668 1498.tmp 1300 1592.tmp 5848 16BA.tmp 1864 17D4.tmp 3408 18ED.tmp 5500 19E7.tmp 4772 1B1F.tmp 3864 1C29.tmp 2612 1D23.tmp 1768 1E8A.tmp 4276 1F75.tmp 6104 2030.tmp 3268 20BD.tmp 2436 2188.tmp 1148 2253.tmp 3388 230F.tmp 5080 23BB.tmp 5800 24C4.tmp 4252 2560.tmp 5460 262C.tmp 1716 26E7.tmp 2116 27D1.tmp 3092 28CB.tmp 628 2958.tmp 3960 2A14.tmp 1824 2ACF.tmp 3776 2B7B.tmp 5304 2BF8.tmp 6072 2C85.tmp 5736 2D30.tmp 3360 2DAD.tmp 5380 2E4A.tmp 1404 2EC7.tmp 4996 2F73.tmp 2788 300F.tmp 2604 309B.tmp 1288 3128.tmp 3376 31D4.tmp 1076 3261.tmp 5040 331C.tmp 4288 3389.tmp 4796 3406.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D72C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 371.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3625.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6553.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 502A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 184C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 493F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D09F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E94D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A171.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A72E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 620.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A520.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A624.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2764 wrote to memory of 852 2764 2026-07-30_abe639b3bb386332ff751239c72e700d_elex_mafia_stealc_tofsee.exe 89 PID 852 wrote to memory of 1976 852 FE7F.tmp 90 PID 1976 wrote to memory of 5756 1976 FF99.tmp 91 PID 5756 wrote to memory of 4384 5756 A2.tmp 92 PID 4384 wrote to memory of 1568 4384 1AC.tmp 93 PID 1568 wrote to memory of 2748 1568 2B5.tmp 94 PID 2748 wrote to memory of 1484 2748 371.tmp 95 PID 1484 wrote to memory of 2576 1484 3FE.tmp 96 PID 2576 wrote to memory of 5728 2576 546.tmp 97 PID 5728 wrote to memory of 2176 5728 620.tmp 98 PID 2176 wrote to memory of 1508 2176 69D.tmp 99 PID 1508 wrote to memory of 2644 1508 7D6.tmp 100 PID 2644 wrote to memory of 3416 2644 90E.tmp 101 PID 3416 wrote to memory of 1460 3416 A95.tmp 102 PID 1460 wrote to memory of 4444 1460 B7F.tmp 103 PID 4444 wrote to memory of 5140 4444 C6A.tmp 104 PID 5140 wrote to memory of 472 5140 D64.tmp 105 PID 472 wrote to memory of 404 472 E9C.tmp 106 PID 404 wrote to memory of 2560 404 F77.tmp 107 PID 2560 wrote to memory of 4172 2560 1061.tmp 108 PID 4172 wrote to memory of 940 4172 11D8.tmp 109 PID 940 wrote to memory of 5968 940 12B3.tmp 110 PID 5968 wrote to memory of 5668 5968 13AD.tmp 111 PID 5668 wrote to memory of 1300 5668 1498.tmp 112 PID 1300 wrote to memory of 5848 1300 1592.tmp 113 PID 5848 wrote to memory of 1864 5848 16BA.tmp 114 PID 1864 wrote to memory of 3408 1864 17D4.tmp 115 PID 3408 wrote to memory of 5500 3408 18ED.tmp 116 PID 5500 wrote to memory of 4772 5500 19E7.tmp 117 PID 4772 wrote to memory of 3864 4772 1B1F.tmp 118 PID 3864 wrote to memory of 2612 3864 1C29.tmp 119 PID 2612 wrote to memory of 1768 2612 1D23.tmp 120 PID 1768 wrote to memory of 4276 1768 1E8A.tmp 121 PID 4276 wrote to memory of 6104 4276 1F75.tmp 122 PID 6104 wrote to memory of 3268 6104 2030.tmp 123 PID 3268 wrote to memory of 2436 3268 20BD.tmp 124 PID 2436 wrote to memory of 1148 2436 2188.tmp 125 PID 1148 wrote to memory of 3388 1148 2253.tmp 126 PID 3388 wrote to memory of 5080 3388 230F.tmp 127 PID 5080 wrote to memory of 5800 5080 23BB.tmp 128 PID 5800 wrote to memory of 4252 5800 24C4.tmp 129 PID 4252 wrote to memory of 5460 4252 2560.tmp 130 PID 5460 wrote to memory of 1716 5460 262C.tmp 131 PID 1716 wrote to memory of 2116 1716 26E7.tmp 132 PID 2116 wrote to memory of 3092 2116 27D1.tmp 133 PID 3092 wrote to memory of 628 3092 28CB.tmp 134 PID 628 wrote to memory of 3960 628 2958.tmp 135 PID 3960 wrote to memory of 1824 3960 2A14.tmp 136 PID 1824 wrote to memory of 3776 1824 2ACF.tmp 137 PID 3776 wrote to memory of 5304 3776 2B7B.tmp 138 PID 5304 wrote to memory of 6072 5304 2BF8.tmp 139 PID 6072 wrote to memory of 5736 6072 2C85.tmp 140 PID 5736 wrote to memory of 3360 5736 2D30.tmp 141 PID 3360 wrote to memory of 5380 3360 2DAD.tmp 142 PID 5380 wrote to memory of 1404 5380 2E4A.tmp 143 PID 1404 wrote to memory of 4996 1404 2EC7.tmp 144 PID 4996 wrote to memory of 2788 4996 2F73.tmp 145 PID 2788 wrote to memory of 2604 2788 300F.tmp 146 PID 2604 wrote to memory of 1288 2604 309B.tmp 147 PID 1288 wrote to memory of 3376 1288 3128.tmp 148 PID 3376 wrote to memory of 1076 3376 31D4.tmp 149 PID 1076 wrote to memory of 5040 1076 3261.tmp 150 PID 5040 wrote to memory of 4288 5040 331C.tmp 151 PID 4288 wrote to memory of 4796 4288 3389.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_abe639b3bb386332ff751239c72e700d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_abe639b3bb386332ff751239c72e700d_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\FF99.tmp"C:\Users\Admin\AppData\Local\Temp\FF99.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\A2.tmp"C:\Users\Admin\AppData\Local\Temp\A2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\1AC.tmp"C:\Users\Admin\AppData\Local\Temp\1AC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\2B5.tmp"C:\Users\Admin\AppData\Local\Temp\2B5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\371.tmp"C:\Users\Admin\AppData\Local\Temp\371.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3FE.tmp"C:\Users\Admin\AppData\Local\Temp\3FE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\546.tmp"C:\Users\Admin\AppData\Local\Temp\546.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\620.tmp"C:\Users\Admin\AppData\Local\Temp\620.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\69D.tmp"C:\Users\Admin\AppData\Local\Temp\69D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\7D6.tmp"C:\Users\Admin\AppData\Local\Temp\7D6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\90E.tmp"C:\Users\Admin\AppData\Local\Temp\90E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\A95.tmp"C:\Users\Admin\AppData\Local\Temp\A95.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\B7F.tmp"C:\Users\Admin\AppData\Local\Temp\B7F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\C6A.tmp"C:\Users\Admin\AppData\Local\Temp\C6A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\D64.tmp"C:\Users\Admin\AppData\Local\Temp\D64.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\E9C.tmp"C:\Users\Admin\AppData\Local\Temp\E9C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\1061.tmp"C:\Users\Admin\AppData\Local\Temp\1061.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\11D8.tmp"C:\Users\Admin\AppData\Local\Temp\11D8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\12B3.tmp"C:\Users\Admin\AppData\Local\Temp\12B3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\13AD.tmp"C:\Users\Admin\AppData\Local\Temp\13AD.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\1498.tmp"C:\Users\Admin\AppData\Local\Temp\1498.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\1592.tmp"C:\Users\Admin\AppData\Local\Temp\1592.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\16BA.tmp"C:\Users\Admin\AppData\Local\Temp\16BA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\1C29.tmp"C:\Users\Admin\AppData\Local\Temp\1C29.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\1D23.tmp"C:\Users\Admin\AppData\Local\Temp\1D23.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\2030.tmp"C:\Users\Admin\AppData\Local\Temp\2030.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\20BD.tmp"C:\Users\Admin\AppData\Local\Temp\20BD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\2188.tmp"C:\Users\Admin\AppData\Local\Temp\2188.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\2253.tmp"C:\Users\Admin\AppData\Local\Temp\2253.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\230F.tmp"C:\Users\Admin\AppData\Local\Temp\230F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\23BB.tmp"C:\Users\Admin\AppData\Local\Temp\23BB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\2560.tmp"C:\Users\Admin\AppData\Local\Temp\2560.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\262C.tmp"C:\Users\Admin\AppData\Local\Temp\262C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\26E7.tmp"C:\Users\Admin\AppData\Local\Temp\26E7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\27D1.tmp"C:\Users\Admin\AppData\Local\Temp\27D1.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\28CB.tmp"C:\Users\Admin\AppData\Local\Temp\28CB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\2958.tmp"C:\Users\Admin\AppData\Local\Temp\2958.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\2A14.tmp"C:\Users\Admin\AppData\Local\Temp\2A14.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\2C85.tmp"C:\Users\Admin\AppData\Local\Temp\2C85.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\2D30.tmp"C:\Users\Admin\AppData\Local\Temp\2D30.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\2E4A.tmp"C:\Users\Admin\AppData\Local\Temp\2E4A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\2F73.tmp"C:\Users\Admin\AppData\Local\Temp\2F73.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\300F.tmp"C:\Users\Admin\AppData\Local\Temp\300F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\309B.tmp"C:\Users\Admin\AppData\Local\Temp\309B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3128.tmp"C:\Users\Admin\AppData\Local\Temp\3128.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\31D4.tmp"C:\Users\Admin\AppData\Local\Temp\31D4.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\3389.tmp"C:\Users\Admin\AppData\Local\Temp\3389.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\3406.tmp"C:\Users\Admin\AppData\Local\Temp\3406.tmp"65⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\3483.tmp"C:\Users\Admin\AppData\Local\Temp\3483.tmp"66⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\3510.tmp"C:\Users\Admin\AppData\Local\Temp\3510.tmp"67⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\358D.tmp"C:\Users\Admin\AppData\Local\Temp\358D.tmp"68⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\360A.tmp"C:\Users\Admin\AppData\Local\Temp\360A.tmp"69⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\3687.tmp"C:\Users\Admin\AppData\Local\Temp\3687.tmp"70⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\36F4.tmp"C:\Users\Admin\AppData\Local\Temp\36F4.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\3771.tmp"C:\Users\Admin\AppData\Local\Temp\3771.tmp"72⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\37EE.tmp"C:\Users\Admin\AppData\Local\Temp\37EE.tmp"73⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\388B.tmp"C:\Users\Admin\AppData\Local\Temp\388B.tmp"74⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\3917.tmp"C:\Users\Admin\AppData\Local\Temp\3917.tmp"75⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\39A4.tmp"C:\Users\Admin\AppData\Local\Temp\39A4.tmp"76⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\3A11.tmp"C:\Users\Admin\AppData\Local\Temp\3A11.tmp"77⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\3A7F.tmp"C:\Users\Admin\AppData\Local\Temp\3A7F.tmp"78⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"79⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\3B79.tmp"C:\Users\Admin\AppData\Local\Temp\3B79.tmp"80⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\3C05.tmp"C:\Users\Admin\AppData\Local\Temp\3C05.tmp"81⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\3C92.tmp"C:\Users\Admin\AppData\Local\Temp\3C92.tmp"82⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\3D0F.tmp"C:\Users\Admin\AppData\Local\Temp\3D0F.tmp"83⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\3E09.tmp"C:\Users\Admin\AppData\Local\Temp\3E09.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"88⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"89⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\4107.tmp"C:\Users\Admin\AppData\Local\Temp\4107.tmp"90⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\4174.tmp"C:\Users\Admin\AppData\Local\Temp\4174.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\4210.tmp"C:\Users\Admin\AppData\Local\Temp\4210.tmp"92⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\429D.tmp"C:\Users\Admin\AppData\Local\Temp\429D.tmp"93⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\4339.tmp"C:\Users\Admin\AppData\Local\Temp\4339.tmp"94⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\43A6.tmp"C:\Users\Admin\AppData\Local\Temp\43A6.tmp"95⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\4423.tmp"C:\Users\Admin\AppData\Local\Temp\4423.tmp"96⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\44B0.tmp"C:\Users\Admin\AppData\Local\Temp\44B0.tmp"97⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\451D.tmp"C:\Users\Admin\AppData\Local\Temp\451D.tmp"98⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\459A.tmp"C:\Users\Admin\AppData\Local\Temp\459A.tmp"99⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\4617.tmp"C:\Users\Admin\AppData\Local\Temp\4617.tmp"100⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"101⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\4721.tmp"C:\Users\Admin\AppData\Local\Temp\4721.tmp"102⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\478E.tmp"C:\Users\Admin\AppData\Local\Temp\478E.tmp"103⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\480B.tmp"C:\Users\Admin\AppData\Local\Temp\480B.tmp"104⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"105⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\48F6.tmp"C:\Users\Admin\AppData\Local\Temp\48F6.tmp"106⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\4973.tmp"C:\Users\Admin\AppData\Local\Temp\4973.tmp"107⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\49FF.tmp"C:\Users\Admin\AppData\Local\Temp\49FF.tmp"108⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"109⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\4B09.tmp"C:\Users\Admin\AppData\Local\Temp\4B09.tmp"110⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\4B86.tmp"C:\Users\Admin\AppData\Local\Temp\4B86.tmp"111⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4C03.tmp"C:\Users\Admin\AppData\Local\Temp\4C03.tmp"112⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\4C90.tmp"C:\Users\Admin\AppData\Local\Temp\4C90.tmp"113⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"114⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"115⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\4E26.tmp"C:\Users\Admin\AppData\Local\Temp\4E26.tmp"116⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"117⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\4F30.tmp"C:\Users\Admin\AppData\Local\Temp\4F30.tmp"118⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"119⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\502A.tmp"C:\Users\Admin\AppData\Local\Temp\502A.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\50B6.tmp"C:\Users\Admin\AppData\Local\Temp\50B6.tmp"121⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\5152.tmp"C:\Users\Admin\AppData\Local\Temp\5152.tmp"122⤵PID:4516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-