Analysis
- max time kernel
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_05fbb2c19430ed4b41cc0ae30974822e_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_05fbb2c19430ed4b41cc0ae30974822e_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_05fbb2c19430ed4b41cc0ae30974822e_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260801-2effmsydnf
- SHA256 6c85f55067d4937e41afa3959502bfa38b6bb9ca4caa6948043fbb26615df67f
- MD5 05fbb2c19430ed4b41cc0ae30974822e
- SHA1 7a24db7f1d24c5d391c79906fb4fec13d7b4e5d7
- SHA512 bb7c3e7489735de3bc712a6750896087418c9ab6b7fe9d28da1c6b63d1317f5c6b7111c9f7311405613611b7f5286ded6443a2e0a01727129009d986173bd284
- SSDEEP 12288:9U5rCOTei6PMuE9fwuYkmgAJs7ZMORdSBqZoXWjdq:9UQOJ6kuRuVUC9RdSBqqGh
- TLSH T1F1C4F125B585C032E59212344AE6EBB2597F7D319B26A0C77B80776E6FB12E1E334307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5448 F497.tmp 2164 F553.tmp 1268 F60E.tmp 4584 F718.tmp 4672 F7F3.tmp 4660 F870.tmp 2984 F8CD.tmp 5316 F93B.tmp 5000 FA16.tmp 2676 FA93.tmp 4520 FB1F.tmp 5736 FBCB.tmp 2412 FCB5.tmp 5744 FD90.tmp 5508 FE6B.tmp 2564 FF46.tmp 2576 FFF2.tmp 4888 9D.tmp 996 178.tmp 5088 1E6.tmp 1336 2B1.tmp 6056 38B.tmp 5636 457.tmp 6084 541.tmp 4196 5FC.tmp 4756 6C8.tmp 5400 783.tmp 2960 86D.tmp 5748 929.tmp 4444 A13.tmp 5780 ACF.tmp 4140 B9A.tmp 5808 C17.tmp 3512 C94.tmp 2520 D11.tmp 1124 D8E.tmp 5264 E1B.tmp 5480 EA7.tmp 5996 F24.tmp 948 FA1.tmp 1072 104D.tmp 1132 10E9.tmp 6076 1186.tmp 1908 1222.tmp 1600 129F.tmp 3304 131C.tmp 2708 13A8.tmp 2260 1425.tmp 5556 14C2.tmp 4460 154E.tmp 1504 15DB.tmp 4976 1658.tmp 1948 1713.tmp 2108 1790.tmp 108 181D.tmp 4300 189A.tmp 344 1936.tmp 4860 19B3.tmp 5108 1A21.tmp 1660 1A8E.tmp 476 1B0B.tmp 2388 1BA7.tmp 4768 1C44.tmp 2952 1CD0.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F108.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 665.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 779D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 189A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 296E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E386.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F80D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3053.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 129F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C502.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D89A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56FB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5020 wrote to memory of 5448 5020 2026-08-01_05fbb2c19430ed4b41cc0ae30974822e_elex_mafia_stealc_tofsee.exe 88 PID 5448 wrote to memory of 2164 5448 F497.tmp 89 PID 2164 wrote to memory of 1268 2164 F553.tmp 90 PID 1268 wrote to memory of 4584 1268 F60E.tmp 91 PID 4584 wrote to memory of 4672 4584 F718.tmp 92 PID 4672 wrote to memory of 4660 4672 F7F3.tmp 93 PID 4660 wrote to memory of 2984 4660 F870.tmp 94 PID 2984 wrote to memory of 5316 2984 F8CD.tmp 95 PID 5316 wrote to memory of 5000 5316 F93B.tmp 96 PID 5000 wrote to memory of 2676 5000 FA16.tmp 97 PID 2676 wrote to memory of 4520 2676 FA93.tmp 98 PID 4520 wrote to memory of 5736 4520 FB1F.tmp 99 PID 5736 wrote to memory of 2412 5736 FBCB.tmp 100 PID 2412 wrote to memory of 5744 2412 FCB5.tmp 101 PID 5744 wrote to memory of 5508 5744 FD90.tmp 102 PID 5508 wrote to memory of 2564 5508 FE6B.tmp 103 PID 2564 wrote to memory of 2576 2564 FF46.tmp 104 PID 2576 wrote to memory of 4888 2576 FFF2.tmp 105 PID 4888 wrote to memory of 996 4888 9D.tmp 106 PID 996 wrote to memory of 5088 996 178.tmp 107 PID 5088 wrote to memory of 1336 5088 1E6.tmp 108 PID 1336 wrote to memory of 6056 1336 2B1.tmp 109 PID 6056 wrote to memory of 5636 6056 38B.tmp 110 PID 5636 wrote to memory of 6084 5636 457.tmp 111 PID 6084 wrote to memory of 4196 6084 541.tmp 112 PID 4196 wrote to memory of 4756 4196 5FC.tmp 113 PID 4756 wrote to memory of 5400 4756 6C8.tmp 114 PID 5400 wrote to memory of 2960 5400 783.tmp 115 PID 2960 wrote to memory of 5748 2960 86D.tmp 116 PID 5748 wrote to memory of 4444 5748 929.tmp 117 PID 4444 wrote to memory of 5780 4444 A13.tmp 118 PID 5780 wrote to memory of 4140 5780 ACF.tmp 119 PID 4140 wrote to memory of 5808 4140 B9A.tmp 120 PID 5808 wrote to memory of 3512 5808 C17.tmp 121 PID 3512 wrote to memory of 2520 3512 C94.tmp 122 PID 2520 wrote to memory of 1124 2520 D11.tmp 123 PID 1124 wrote to memory of 5264 1124 D8E.tmp 124 PID 5264 wrote to memory of 5480 5264 E1B.tmp 125 PID 5480 wrote to memory of 5996 5480 EA7.tmp 126 PID 5996 wrote to memory of 948 5996 F24.tmp 127 PID 948 wrote to memory of 1072 948 FA1.tmp 128 PID 1072 wrote to memory of 1132 1072 104D.tmp 129 PID 1132 wrote to memory of 6076 1132 10E9.tmp 130 PID 6076 wrote to memory of 1908 6076 1186.tmp 131 PID 1908 wrote to memory of 1600 1908 1222.tmp 132 PID 1600 wrote to memory of 3304 1600 129F.tmp 133 PID 3304 wrote to memory of 2708 3304 131C.tmp 134 PID 2708 wrote to memory of 2260 2708 13A8.tmp 135 PID 2260 wrote to memory of 5556 2260 1425.tmp 136 PID 5556 wrote to memory of 4460 5556 14C2.tmp 137 PID 4460 wrote to memory of 1504 4460 154E.tmp 138 PID 1504 wrote to memory of 4976 1504 15DB.tmp 139 PID 4976 wrote to memory of 1948 4976 1658.tmp 140 PID 1948 wrote to memory of 2108 1948 1713.tmp 141 PID 2108 wrote to memory of 108 2108 1790.tmp 142 PID 108 wrote to memory of 4300 108 181D.tmp 143 PID 4300 wrote to memory of 344 4300 189A.tmp 144 PID 344 wrote to memory of 4860 344 1936.tmp 145 PID 4860 wrote to memory of 5108 4860 19B3.tmp 146 PID 5108 wrote to memory of 1660 5108 1A21.tmp 147 PID 1660 wrote to memory of 476 1660 1A8E.tmp 148 PID 476 wrote to memory of 2388 476 1B0B.tmp 149 PID 2388 wrote to memory of 4768 2388 1BA7.tmp 150 PID 4768 wrote to memory of 2952 4768 1C44.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_05fbb2c19430ed4b41cc0ae30974822e_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_05fbb2c19430ed4b41cc0ae30974822e_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\F60E.tmp"C:\Users\Admin\AppData\Local\Temp\F60E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\F718.tmp"C:\Users\Admin\AppData\Local\Temp\F718.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\F870.tmp"C:\Users\Admin\AppData\Local\Temp\F870.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\F93B.tmp"C:\Users\Admin\AppData\Local\Temp\F93B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\FA16.tmp"C:\Users\Admin\AppData\Local\Temp\FA16.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\FA93.tmp"C:\Users\Admin\AppData\Local\Temp\FA93.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\FD90.tmp"C:\Users\Admin\AppData\Local\Temp\FD90.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\FF46.tmp"C:\Users\Admin\AppData\Local\Temp\FF46.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\178.tmp"C:\Users\Admin\AppData\Local\Temp\178.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\1E6.tmp"C:\Users\Admin\AppData\Local\Temp\1E6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\2B1.tmp"C:\Users\Admin\AppData\Local\Temp\2B1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\38B.tmp"C:\Users\Admin\AppData\Local\Temp\38B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\457.tmp"C:\Users\Admin\AppData\Local\Temp\457.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\541.tmp"C:\Users\Admin\AppData\Local\Temp\541.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\5FC.tmp"C:\Users\Admin\AppData\Local\Temp\5FC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\6C8.tmp"C:\Users\Admin\AppData\Local\Temp\6C8.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\783.tmp"C:\Users\Admin\AppData\Local\Temp\783.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\86D.tmp"C:\Users\Admin\AppData\Local\Temp\86D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\929.tmp"C:\Users\Admin\AppData\Local\Temp\929.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\A13.tmp"C:\Users\Admin\AppData\Local\Temp\A13.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\ACF.tmp"C:\Users\Admin\AppData\Local\Temp\ACF.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\B9A.tmp"C:\Users\Admin\AppData\Local\Temp\B9A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\C17.tmp"C:\Users\Admin\AppData\Local\Temp\C17.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\C94.tmp"C:\Users\Admin\AppData\Local\Temp\C94.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\D11.tmp"C:\Users\Admin\AppData\Local\Temp\D11.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\D8E.tmp"C:\Users\Admin\AppData\Local\Temp\D8E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\E1B.tmp"C:\Users\Admin\AppData\Local\Temp\E1B.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\EA7.tmp"C:\Users\Admin\AppData\Local\Temp\EA7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\F24.tmp"C:\Users\Admin\AppData\Local\Temp\F24.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\FA1.tmp"C:\Users\Admin\AppData\Local\Temp\FA1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\104D.tmp"C:\Users\Admin\AppData\Local\Temp\104D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\10E9.tmp"C:\Users\Admin\AppData\Local\Temp\10E9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\1186.tmp"C:\Users\Admin\AppData\Local\Temp\1186.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\1222.tmp"C:\Users\Admin\AppData\Local\Temp\1222.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\129F.tmp"C:\Users\Admin\AppData\Local\Temp\129F.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\13A8.tmp"C:\Users\Admin\AppData\Local\Temp\13A8.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\1425.tmp"C:\Users\Admin\AppData\Local\Temp\1425.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\14C2.tmp"C:\Users\Admin\AppData\Local\Temp\14C2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\154E.tmp"C:\Users\Admin\AppData\Local\Temp\154E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\15DB.tmp"C:\Users\Admin\AppData\Local\Temp\15DB.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\1713.tmp"C:\Users\Admin\AppData\Local\Temp\1713.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\181D.tmp"C:\Users\Admin\AppData\Local\Temp\181D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\189A.tmp"C:\Users\Admin\AppData\Local\Temp\189A.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\1936.tmp"C:\Users\Admin\AppData\Local\Temp\1936.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\19B3.tmp"C:\Users\Admin\AppData\Local\Temp\19B3.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\1A8E.tmp"C:\Users\Admin\AppData\Local\Temp\1A8E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\1C44.tmp"C:\Users\Admin\AppData\Local\Temp\1C44.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\1CD0.tmp"C:\Users\Admin\AppData\Local\Temp\1CD0.tmp"65⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"66⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\1E66.tmp"C:\Users\Admin\AppData\Local\Temp\1E66.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\1F12.tmp"C:\Users\Admin\AppData\Local\Temp\1F12.tmp"69⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\1F9F.tmp"C:\Users\Admin\AppData\Local\Temp\1F9F.tmp"70⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\201C.tmp"C:\Users\Admin\AppData\Local\Temp\201C.tmp"71⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\2099.tmp"C:\Users\Admin\AppData\Local\Temp\2099.tmp"72⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2106.tmp"C:\Users\Admin\AppData\Local\Temp\2106.tmp"73⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\2183.tmp"C:\Users\Admin\AppData\Local\Temp\2183.tmp"74⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\2200.tmp"C:\Users\Admin\AppData\Local\Temp\2200.tmp"75⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\227D.tmp"C:\Users\Admin\AppData\Local\Temp\227D.tmp"76⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\22FA.tmp"C:\Users\Admin\AppData\Local\Temp\22FA.tmp"77⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"78⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"79⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"80⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"81⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"82⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"83⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"84⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"85⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"86⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\27AD.tmp"C:\Users\Admin\AppData\Local\Temp\27AD.tmp"87⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\283A.tmp"C:\Users\Admin\AppData\Local\Temp\283A.tmp"88⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\28B7.tmp"C:\Users\Admin\AppData\Local\Temp\28B7.tmp"89⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\2934.tmp"C:\Users\Admin\AppData\Local\Temp\2934.tmp"90⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\29D0.tmp"C:\Users\Admin\AppData\Local\Temp\29D0.tmp"91⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"92⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"93⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\2B95.tmp"C:\Users\Admin\AppData\Local\Temp\2B95.tmp"94⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\2C22.tmp"C:\Users\Admin\AppData\Local\Temp\2C22.tmp"95⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"96⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\2D2C.tmp"C:\Users\Admin\AppData\Local\Temp\2D2C.tmp"97⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\2DA9.tmp"C:\Users\Admin\AppData\Local\Temp\2DA9.tmp"98⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\2E16.tmp"C:\Users\Admin\AppData\Local\Temp\2E16.tmp"99⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\2E93.tmp"C:\Users\Admin\AppData\Local\Temp\2E93.tmp"100⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\2F20.tmp"C:\Users\Admin\AppData\Local\Temp\2F20.tmp"101⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\2F7D.tmp"C:\Users\Admin\AppData\Local\Temp\2F7D.tmp"102⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2FFA.tmp"C:\Users\Admin\AppData\Local\Temp\2FFA.tmp"103⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\3077.tmp"C:\Users\Admin\AppData\Local\Temp\3077.tmp"104⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\30F4.tmp"C:\Users\Admin\AppData\Local\Temp\30F4.tmp"105⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\3162.tmp"C:\Users\Admin\AppData\Local\Temp\3162.tmp"106⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\31DF.tmp"C:\Users\Admin\AppData\Local\Temp\31DF.tmp"107⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\323D.tmp"C:\Users\Admin\AppData\Local\Temp\323D.tmp"108⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\32BA.tmp"C:\Users\Admin\AppData\Local\Temp\32BA.tmp"109⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\3327.tmp"C:\Users\Admin\AppData\Local\Temp\3327.tmp"110⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\33A4.tmp"C:\Users\Admin\AppData\Local\Temp\33A4.tmp"111⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\3421.tmp"C:\Users\Admin\AppData\Local\Temp\3421.tmp"112⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\349E.tmp"C:\Users\Admin\AppData\Local\Temp\349E.tmp"113⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\353A.tmp"C:\Users\Admin\AppData\Local\Temp\353A.tmp"114⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\35D6.tmp"C:\Users\Admin\AppData\Local\Temp\35D6.tmp"115⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\3644.tmp"C:\Users\Admin\AppData\Local\Temp\3644.tmp"116⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\36C1.tmp"C:\Users\Admin\AppData\Local\Temp\36C1.tmp"117⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\372E.tmp"C:\Users\Admin\AppData\Local\Temp\372E.tmp"118⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\37AB.tmp"C:\Users\Admin\AppData\Local\Temp\37AB.tmp"119⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\3838.tmp"C:\Users\Admin\AppData\Local\Temp\3838.tmp"120⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\38B5.tmp"C:\Users\Admin\AppData\Local\Temp\38B5.tmp"121⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\3932.tmp"C:\Users\Admin\AppData\Local\Temp\3932.tmp"122⤵PID:4268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-