Analysis
- max time kernel
129s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 01:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_13340875735691a9dbb3b95d2d10b062_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_13340875735691a9dbb3b95d2d10b062_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_13340875735691a9dbb3b95d2d10b062_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-bn23wsbl2y
- SHA256 537b08a2633e9181576db1049aae2b4e6f43c6c3564db54e64c7cebc9002971b
- MD5 13340875735691a9dbb3b95d2d10b062
- SHA1 853edd0c976ce90644c1929de518289dbfd96902
- SHA512 26776d5171dfad26e595741a3b12f05e7cde80d6d945ceedafad25d3e78b5d3bc2c951f89c330cd775dccc29fe62b2db65ab893a67ed99250ff5ca81d778e705
- SSDEEP 12288:wU5rCOTeiD6Y+kR4rtAhJoTftGXxLJeNZ+3/v+I9hUG2VA:wUQOJDDTRuah0ftGLeNGEA
- TLSH T182E4D02177D88532E5FB037859B5E6604D7EBD32A722D6CF6F8025AE4971BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3384 DFD7.tmp 3360 E10F.tmp 4472 E342.tmp 2392 E40D.tmp 2380 E4A9.tmp 4844 E630.tmp 4744 E71A.tmp 2068 E862.tmp 2792 E96C.tmp 468 EA66.tmp 1184 EB7F.tmp 4632 EC5A.tmp 3680 ED54.tmp 5932 EE2F.tmp 2400 EEEA.tmp 5444 EF58.tmp 5076 EFC5.tmp 2540 F052.tmp 1716 F17A.tmp 1736 F274.tmp 2952 F320.tmp 4764 F3BD.tmp 5108 F478.tmp 4440 F5A1.tmp 4224 F6E9.tmp 4856 F7F3.tmp 2484 F90C.tmp 5548 FA25.tmp 4880 FB9C.tmp 5856 FCB5.tmp 5712 FDCF.tmp 6032 FED8.tmp 2900 1.tmp 4164 AD.tmp 2768 13A.tmp 5376 1E6.tmp 2780 2D0.tmp 2332 36C.tmp 1756 447.tmp 1292 502.tmp 4504 57F.tmp 4640 64B.tmp 5588 706.tmp 3712 7D1.tmp 4024 86D.tmp 1352 919.tmp 1324 9E4.tmp 4156 A90.tmp 4116 AFE.tmp 5600 B6B.tmp 5312 BD8.tmp 2920 C46.tmp 3812 CD2.tmp 5308 D40.tmp 4516 DAD.tmp 1800 E1B.tmp 5888 EA7.tmp 2080 F24.tmp 5768 FA1.tmp 4556 100F.tmp 52 109B.tmp 5972 1128.tmp 260 11A5.tmp 1744 1260.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D609.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 848E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E986.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C62B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4572.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 445D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D216.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6250.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 3384 2008 2026-08-01_13340875735691a9dbb3b95d2d10b062_elex_mafia_stealc_tofsee.exe 88 PID 3384 wrote to memory of 3360 3384 DFD7.tmp 89 PID 3360 wrote to memory of 4472 3360 E10F.tmp 90 PID 4472 wrote to memory of 2392 4472 E342.tmp 91 PID 2392 wrote to memory of 2380 2392 E40D.tmp 92 PID 2380 wrote to memory of 4844 2380 E4A9.tmp 93 PID 4844 wrote to memory of 4744 4844 E630.tmp 94 PID 4744 wrote to memory of 2068 4744 E71A.tmp 95 PID 2068 wrote to memory of 2792 2068 E862.tmp 96 PID 2792 wrote to memory of 468 2792 E96C.tmp 97 PID 468 wrote to memory of 1184 468 EA66.tmp 98 PID 1184 wrote to memory of 4632 1184 EB7F.tmp 99 PID 4632 wrote to memory of 3680 4632 EC5A.tmp 100 PID 3680 wrote to memory of 5932 3680 ED54.tmp 101 PID 5932 wrote to memory of 2400 5932 EE2F.tmp 102 PID 2400 wrote to memory of 5444 2400 EEEA.tmp 103 PID 5444 wrote to memory of 5076 5444 EF58.tmp 104 PID 5076 wrote to memory of 2540 5076 EFC5.tmp 105 PID 2540 wrote to memory of 1716 2540 F052.tmp 106 PID 1716 wrote to memory of 1736 1716 F17A.tmp 107 PID 1736 wrote to memory of 2952 1736 F274.tmp 108 PID 2952 wrote to memory of 4764 2952 F320.tmp 109 PID 4764 wrote to memory of 5108 4764 F3BD.tmp 110 PID 5108 wrote to memory of 4440 5108 F478.tmp 111 PID 4440 wrote to memory of 4224 4440 F5A1.tmp 112 PID 4224 wrote to memory of 4856 4224 F6E9.tmp 113 PID 4856 wrote to memory of 2484 4856 F7F3.tmp 114 PID 2484 wrote to memory of 5548 2484 F90C.tmp 115 PID 5548 wrote to memory of 4880 5548 FA25.tmp 116 PID 4880 wrote to memory of 5856 4880 FB9C.tmp 117 PID 5856 wrote to memory of 5712 5856 FCB5.tmp 118 PID 5712 wrote to memory of 6032 5712 FDCF.tmp 119 PID 6032 wrote to memory of 2900 6032 FED8.tmp 120 PID 2900 wrote to memory of 4164 2900 1.tmp 121 PID 4164 wrote to memory of 2768 4164 AD.tmp 122 PID 2768 wrote to memory of 5376 2768 13A.tmp 123 PID 5376 wrote to memory of 2780 5376 1E6.tmp 124 PID 2780 wrote to memory of 2332 2780 2D0.tmp 125 PID 2332 wrote to memory of 1756 2332 36C.tmp 126 PID 1756 wrote to memory of 1292 1756 447.tmp 127 PID 1292 wrote to memory of 4504 1292 502.tmp 128 PID 4504 wrote to memory of 4640 4504 57F.tmp 129 PID 4640 wrote to memory of 5588 4640 64B.tmp 130 PID 5588 wrote to memory of 3712 5588 706.tmp 131 PID 3712 wrote to memory of 4024 3712 7D1.tmp 132 PID 4024 wrote to memory of 1352 4024 86D.tmp 133 PID 1352 wrote to memory of 1324 1352 919.tmp 134 PID 1324 wrote to memory of 4156 1324 9E4.tmp 135 PID 4156 wrote to memory of 4116 4156 A90.tmp 136 PID 4116 wrote to memory of 5600 4116 AFE.tmp 137 PID 5600 wrote to memory of 5312 5600 B6B.tmp 138 PID 5312 wrote to memory of 2920 5312 BD8.tmp 139 PID 2920 wrote to memory of 3812 2920 C46.tmp 140 PID 3812 wrote to memory of 5308 3812 CD2.tmp 141 PID 5308 wrote to memory of 4516 5308 D40.tmp 142 PID 4516 wrote to memory of 1800 4516 DAD.tmp 143 PID 1800 wrote to memory of 5888 1800 E1B.tmp 144 PID 5888 wrote to memory of 2080 5888 EA7.tmp 145 PID 2080 wrote to memory of 5768 2080 F24.tmp 146 PID 5768 wrote to memory of 4556 5768 FA1.tmp 147 PID 4556 wrote to memory of 52 4556 100F.tmp 148 PID 52 wrote to memory of 5972 52 109B.tmp 149 PID 5972 wrote to memory of 260 5972 1128.tmp 150 PID 260 wrote to memory of 1744 260 11A5.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_13340875735691a9dbb3b95d2d10b062_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_13340875735691a9dbb3b95d2d10b062_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\E10F.tmp"C:\Users\Admin\AppData\Local\Temp\E10F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\E342.tmp"C:\Users\Admin\AppData\Local\Temp\E342.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\E40D.tmp"C:\Users\Admin\AppData\Local\Temp\E40D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\E630.tmp"C:\Users\Admin\AppData\Local\Temp\E630.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\E71A.tmp"C:\Users\Admin\AppData\Local\Temp\E71A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\E862.tmp"C:\Users\Admin\AppData\Local\Temp\E862.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\E96C.tmp"C:\Users\Admin\AppData\Local\Temp\E96C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\EA66.tmp"C:\Users\Admin\AppData\Local\Temp\EA66.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\EF58.tmp"C:\Users\Admin\AppData\Local\Temp\EF58.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\F052.tmp"C:\Users\Admin\AppData\Local\Temp\F052.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\F17A.tmp"C:\Users\Admin\AppData\Local\Temp\F17A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\F274.tmp"C:\Users\Admin\AppData\Local\Temp\F274.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\F320.tmp"C:\Users\Admin\AppData\Local\Temp\F320.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\F478.tmp"C:\Users\Admin\AppData\Local\Temp\F478.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\F90C.tmp"C:\Users\Admin\AppData\Local\Temp\F90C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\FA25.tmp"C:\Users\Admin\AppData\Local\Temp\FA25.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\FB9C.tmp"C:\Users\Admin\AppData\Local\Temp\FB9C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\1.tmp"C:\Users\Admin\AppData\Local\Temp\1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\AD.tmp"C:\Users\Admin\AppData\Local\Temp\AD.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\13A.tmp"C:\Users\Admin\AppData\Local\Temp\13A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\1E6.tmp"C:\Users\Admin\AppData\Local\Temp\1E6.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\2D0.tmp"C:\Users\Admin\AppData\Local\Temp\2D0.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\36C.tmp"C:\Users\Admin\AppData\Local\Temp\36C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\447.tmp"C:\Users\Admin\AppData\Local\Temp\447.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\502.tmp"C:\Users\Admin\AppData\Local\Temp\502.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\57F.tmp"C:\Users\Admin\AppData\Local\Temp\57F.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\64B.tmp"C:\Users\Admin\AppData\Local\Temp\64B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\706.tmp"C:\Users\Admin\AppData\Local\Temp\706.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\7D1.tmp"C:\Users\Admin\AppData\Local\Temp\7D1.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\86D.tmp"C:\Users\Admin\AppData\Local\Temp\86D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\919.tmp"C:\Users\Admin\AppData\Local\Temp\919.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\9E4.tmp"C:\Users\Admin\AppData\Local\Temp\9E4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\A90.tmp"C:\Users\Admin\AppData\Local\Temp\A90.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\AFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFE.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\B6B.tmp"C:\Users\Admin\AppData\Local\Temp\B6B.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\BD8.tmp"C:\Users\Admin\AppData\Local\Temp\BD8.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\C46.tmp"C:\Users\Admin\AppData\Local\Temp\C46.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\CD2.tmp"C:\Users\Admin\AppData\Local\Temp\CD2.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\D40.tmp"C:\Users\Admin\AppData\Local\Temp\D40.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\DAD.tmp"C:\Users\Admin\AppData\Local\Temp\DAD.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\E1B.tmp"C:\Users\Admin\AppData\Local\Temp\E1B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\EA7.tmp"C:\Users\Admin\AppData\Local\Temp\EA7.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\F24.tmp"C:\Users\Admin\AppData\Local\Temp\F24.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\FA1.tmp"C:\Users\Admin\AppData\Local\Temp\FA1.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\100F.tmp"C:\Users\Admin\AppData\Local\Temp\100F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\109B.tmp"C:\Users\Admin\AppData\Local\Temp\109B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\1128.tmp"C:\Users\Admin\AppData\Local\Temp\1128.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\11A5.tmp"C:\Users\Admin\AppData\Local\Temp\11A5.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\1260.tmp"C:\Users\Admin\AppData\Local\Temp\1260.tmp"65⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\12DD.tmp"C:\Users\Admin\AppData\Local\Temp\12DD.tmp"66⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\136A.tmp"C:\Users\Admin\AppData\Local\Temp\136A.tmp"67⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\1406.tmp"C:\Users\Admin\AppData\Local\Temp\1406.tmp"68⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\1483.tmp"C:\Users\Admin\AppData\Local\Temp\1483.tmp"69⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\1510.tmp"C:\Users\Admin\AppData\Local\Temp\1510.tmp"70⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\15AC.tmp"C:\Users\Admin\AppData\Local\Temp\15AC.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:792 -
C:\Users\Admin\AppData\Local\Temp\1629.tmp"C:\Users\Admin\AppData\Local\Temp\1629.tmp"72⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\16B6.tmp"C:\Users\Admin\AppData\Local\Temp\16B6.tmp"73⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\1742.tmp"C:\Users\Admin\AppData\Local\Temp\1742.tmp"74⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\17B0.tmp"C:\Users\Admin\AppData\Local\Temp\17B0.tmp"75⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\182D.tmp"C:\Users\Admin\AppData\Local\Temp\182D.tmp"76⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\18B9.tmp"C:\Users\Admin\AppData\Local\Temp\18B9.tmp"77⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\1946.tmp"C:\Users\Admin\AppData\Local\Temp\1946.tmp"78⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\19B3.tmp"C:\Users\Admin\AppData\Local\Temp\19B3.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\1A50.tmp"C:\Users\Admin\AppData\Local\Temp\1A50.tmp"80⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"81⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\1B59.tmp"C:\Users\Admin\AppData\Local\Temp\1B59.tmp"82⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"83⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\1C53.tmp"C:\Users\Admin\AppData\Local\Temp\1C53.tmp"84⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"85⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"86⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\1E09.tmp"C:\Users\Admin\AppData\Local\Temp\1E09.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\1E86.tmp"C:\Users\Admin\AppData\Local\Temp\1E86.tmp"88⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\1EF3.tmp"C:\Users\Admin\AppData\Local\Temp\1EF3.tmp"89⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\1F70.tmp"C:\Users\Admin\AppData\Local\Temp\1F70.tmp"90⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\1FED.tmp"C:\Users\Admin\AppData\Local\Temp\1FED.tmp"91⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\207A.tmp"C:\Users\Admin\AppData\Local\Temp\207A.tmp"92⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\2116.tmp"C:\Users\Admin\AppData\Local\Temp\2116.tmp"93⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\21A3.tmp"C:\Users\Admin\AppData\Local\Temp\21A3.tmp"94⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2210.tmp"C:\Users\Admin\AppData\Local\Temp\2210.tmp"95⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\22AC.tmp"C:\Users\Admin\AppData\Local\Temp\22AC.tmp"96⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\2339.tmp"C:\Users\Admin\AppData\Local\Temp\2339.tmp"97⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\23C5.tmp"C:\Users\Admin\AppData\Local\Temp\23C5.tmp"98⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"99⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"100⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"101⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"102⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2675.tmp"C:\Users\Admin\AppData\Local\Temp\2675.tmp"103⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\2711.tmp"C:\Users\Admin\AppData\Local\Temp\2711.tmp"104⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\279E.tmp"C:\Users\Admin\AppData\Local\Temp\279E.tmp"105⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\281B.tmp"C:\Users\Admin\AppData\Local\Temp\281B.tmp"106⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\2898.tmp"C:\Users\Admin\AppData\Local\Temp\2898.tmp"107⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\2924.tmp"C:\Users\Admin\AppData\Local\Temp\2924.tmp"108⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\29E0.tmp"C:\Users\Admin\AppData\Local\Temp\29E0.tmp"109⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\2A4D.tmp"C:\Users\Admin\AppData\Local\Temp\2A4D.tmp"110⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:704 -
C:\Users\Admin\AppData\Local\Temp\2B67.tmp"C:\Users\Admin\AppData\Local\Temp\2B67.tmp"112⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\2C8F.tmp"C:\Users\Admin\AppData\Local\Temp\2C8F.tmp"114⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\2D1C.tmp"C:\Users\Admin\AppData\Local\Temp\2D1C.tmp"115⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\2DB8.tmp"C:\Users\Admin\AppData\Local\Temp\2DB8.tmp"116⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\2E64.tmp"C:\Users\Admin\AppData\Local\Temp\2E64.tmp"117⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\2EE1.tmp"C:\Users\Admin\AppData\Local\Temp\2EE1.tmp"118⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\2F5E.tmp"C:\Users\Admin\AppData\Local\Temp\2F5E.tmp"119⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\2FDB.tmp"C:\Users\Admin\AppData\Local\Temp\2FDB.tmp"120⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\3068.tmp"C:\Users\Admin\AppData\Local\Temp\3068.tmp"121⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3104.tmp"C:\Users\Admin\AppData\Local\Temp\3104.tmp"122⤵PID:5096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-