Analysis
- max time kernel
134s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 03:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_00c719de269e48e2926c2db95a0f399e_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_00c719de269e48e2926c2db95a0f399e_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-05_00c719de269e48e2926c2db95a0f399e_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260805-dzykysam2v
- SHA256 b59ecb5c1d84a3451fd0d56d3dae0b9b3fbfbb3f1d5611a7ceae50a42db9d123
- MD5 00c719de269e48e2926c2db95a0f399e
- SHA1 fa9bfa84ffefdda1ee03af640340d02648a8ef67
- SHA512 d7c70bd284d0f84c4e609759f3f7fe03262ffe9f8f7ac17a25b96cd08ca663b33bcdfbc33a23de784e2574a6b7990a8c2cf997c16da182ef6641acc196a9a273
- SSDEEP 12288:wU5rCOTeiDdkAwmtwzGCh8uE+5O8w2KNZ+3/v+I9hUG2VA:wUQOJDdkAwmtwzGCh8uno2KNGEA
- TLSH T1ABE4D02173D8C532E5FB03785AB5E661497EBD32A722D6CF2F8051AE0972BD08671723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4976 E22D.tmp 2996 E3A4.tmp 2080 E55A.tmp 5312 E683.tmp 1924 E7FA.tmp 2052 E8C5.tmp 2448 E9FD.tmp 2952 EB65.tmp 2756 ECBC.tmp 5116 EDF5.tmp 1240 EEEF.tmp 3144 F066.tmp 3668 F170.tmp 3160 F2C7.tmp 5816 F3E1.tmp 1432 F538.tmp 124 F680.tmp 5572 F7C9.tmp 3972 F920.tmp 2960 FAD6.tmp 2844 FBFF.tmp 1956 FD76.tmp 6052 FE9F.tmp 2520 FFE7.tmp 1172 110.tmp 4444 238.tmp 5192 352.tmp 5072 47B.tmp 1308 584.tmp 1800 68E.tmp 1048 7A7.tmp 3184 8D0.tmp 6088 A28.tmp 2456 AE3.tmp 2616 B7F.tmp 2940 C1C.tmp 1880 D25.tmp 3192 DC2.tmp 4684 E5E.tmp 4588 F29.tmp 2972 FD5.tmp 4796 10CF.tmp 3064 117B.tmp 5576 1236.tmp 6008 12C3.tmp 1380 134F.tmp 3580 143A.tmp 3040 1524.tmp 2516 15B1.tmp 4868 164D.tmp 4820 16E9.tmp 4656 1766.tmp 4600 17F3.tmp 2824 188F.tmp 4568 190C.tmp 6000 1999.tmp 1084 1A16.tmp 4768 1AA2.tmp 3292 1B3F.tmp 3424 1BCB.tmp 5464 1C77.tmp 4376 1D04.tmp 4472 1DA0.tmp 2084 1E3C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 481B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1956.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A01A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E89C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 265A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 952D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2730.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E233.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E502.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 327B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 385C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3394.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C53A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB91.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 4976 3576 2026-08-05_00c719de269e48e2926c2db95a0f399e_elex_mafia_stealc_tofsee.exe 89 PID 4976 wrote to memory of 2996 4976 E22D.tmp 90 PID 2996 wrote to memory of 2080 2996 E3A4.tmp 91 PID 2080 wrote to memory of 5312 2080 E55A.tmp 92 PID 5312 wrote to memory of 1924 5312 E683.tmp 93 PID 1924 wrote to memory of 2052 1924 E7FA.tmp 94 PID 2052 wrote to memory of 2448 2052 E8C5.tmp 95 PID 2448 wrote to memory of 2952 2448 E9FD.tmp 96 PID 2952 wrote to memory of 2756 2952 EB65.tmp 97 PID 2756 wrote to memory of 5116 2756 ECBC.tmp 98 PID 5116 wrote to memory of 1240 5116 EDF5.tmp 99 PID 1240 wrote to memory of 3144 1240 EEEF.tmp 100 PID 3144 wrote to memory of 3668 3144 F066.tmp 101 PID 3668 wrote to memory of 3160 3668 F170.tmp 102 PID 3160 wrote to memory of 5816 3160 F2C7.tmp 103 PID 5816 wrote to memory of 1432 5816 F3E1.tmp 104 PID 1432 wrote to memory of 124 1432 F538.tmp 105 PID 124 wrote to memory of 5572 124 F680.tmp 106 PID 5572 wrote to memory of 3972 5572 F7C9.tmp 107 PID 3972 wrote to memory of 2960 3972 F920.tmp 108 PID 2960 wrote to memory of 2844 2960 FAD6.tmp 109 PID 2844 wrote to memory of 1956 2844 FBFF.tmp 110 PID 1956 wrote to memory of 6052 1956 FD76.tmp 111 PID 6052 wrote to memory of 2520 6052 FE9F.tmp 112 PID 2520 wrote to memory of 1172 2520 FFE7.tmp 113 PID 1172 wrote to memory of 4444 1172 110.tmp 114 PID 4444 wrote to memory of 5192 4444 238.tmp 115 PID 5192 wrote to memory of 5072 5192 352.tmp 116 PID 5072 wrote to memory of 1308 5072 47B.tmp 117 PID 1308 wrote to memory of 1800 1308 584.tmp 118 PID 1800 wrote to memory of 1048 1800 68E.tmp 119 PID 1048 wrote to memory of 3184 1048 7A7.tmp 120 PID 3184 wrote to memory of 6088 3184 8D0.tmp 121 PID 6088 wrote to memory of 2456 6088 A28.tmp 122 PID 2456 wrote to memory of 2616 2456 AE3.tmp 123 PID 2616 wrote to memory of 2940 2616 B7F.tmp 124 PID 2940 wrote to memory of 1880 2940 C1C.tmp 125 PID 1880 wrote to memory of 3192 1880 D25.tmp 126 PID 3192 wrote to memory of 4684 3192 DC2.tmp 127 PID 4684 wrote to memory of 4588 4684 E5E.tmp 128 PID 4588 wrote to memory of 2972 4588 F29.tmp 129 PID 2972 wrote to memory of 4796 2972 FD5.tmp 130 PID 4796 wrote to memory of 3064 4796 10CF.tmp 131 PID 3064 wrote to memory of 5576 3064 117B.tmp 132 PID 5576 wrote to memory of 6008 5576 1236.tmp 133 PID 6008 wrote to memory of 1380 6008 12C3.tmp 134 PID 1380 wrote to memory of 3580 1380 134F.tmp 135 PID 3580 wrote to memory of 3040 3580 143A.tmp 136 PID 3040 wrote to memory of 2516 3040 1524.tmp 137 PID 2516 wrote to memory of 4868 2516 15B1.tmp 138 PID 4868 wrote to memory of 4820 4868 164D.tmp 139 PID 4820 wrote to memory of 4656 4820 16E9.tmp 140 PID 4656 wrote to memory of 4600 4656 1766.tmp 141 PID 4600 wrote to memory of 2824 4600 17F3.tmp 142 PID 2824 wrote to memory of 4568 2824 188F.tmp 143 PID 4568 wrote to memory of 6000 4568 190C.tmp 144 PID 6000 wrote to memory of 1084 6000 1999.tmp 145 PID 1084 wrote to memory of 4768 1084 1A16.tmp 146 PID 4768 wrote to memory of 3292 4768 1AA2.tmp 147 PID 3292 wrote to memory of 3424 3292 1B3F.tmp 148 PID 3424 wrote to memory of 5464 3424 1BCB.tmp 149 PID 5464 wrote to memory of 4376 5464 1C77.tmp 150 PID 4376 wrote to memory of 4472 4376 1D04.tmp 151 PID 4472 wrote to memory of 2084 4472 1DA0.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_00c719de269e48e2926c2db95a0f399e_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_00c719de269e48e2926c2db95a0f399e_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\E22D.tmp"C:\Users\Admin\AppData\Local\Temp\E22D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\E55A.tmp"C:\Users\Admin\AppData\Local\Temp\E55A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\E683.tmp"C:\Users\Admin\AppData\Local\Temp\E683.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\E7FA.tmp"C:\Users\Admin\AppData\Local\Temp\E7FA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\EB65.tmp"C:\Users\Admin\AppData\Local\Temp\EB65.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\ECBC.tmp"C:\Users\Admin\AppData\Local\Temp\ECBC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\EEEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEEF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\F066.tmp"C:\Users\Admin\AppData\Local\Temp\F066.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\F170.tmp"C:\Users\Admin\AppData\Local\Temp\F170.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\F680.tmp"C:\Users\Admin\AppData\Local\Temp\F680.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\F920.tmp"C:\Users\Admin\AppData\Local\Temp\F920.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\FAD6.tmp"C:\Users\Admin\AppData\Local\Temp\FAD6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\FD76.tmp"C:\Users\Admin\AppData\Local\Temp\FD76.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\110.tmp"C:\Users\Admin\AppData\Local\Temp\110.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\238.tmp"C:\Users\Admin\AppData\Local\Temp\238.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\352.tmp"C:\Users\Admin\AppData\Local\Temp\352.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\47B.tmp"C:\Users\Admin\AppData\Local\Temp\47B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\584.tmp"C:\Users\Admin\AppData\Local\Temp\584.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\68E.tmp"C:\Users\Admin\AppData\Local\Temp\68E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\7A7.tmp"C:\Users\Admin\AppData\Local\Temp\7A7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\8D0.tmp"C:\Users\Admin\AppData\Local\Temp\8D0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\A28.tmp"C:\Users\Admin\AppData\Local\Temp\A28.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\AE3.tmp"C:\Users\Admin\AppData\Local\Temp\AE3.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\B7F.tmp"C:\Users\Admin\AppData\Local\Temp\B7F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\C1C.tmp"C:\Users\Admin\AppData\Local\Temp\C1C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\D25.tmp"C:\Users\Admin\AppData\Local\Temp\D25.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\DC2.tmp"C:\Users\Admin\AppData\Local\Temp\DC2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\E5E.tmp"C:\Users\Admin\AppData\Local\Temp\E5E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\F29.tmp"C:\Users\Admin\AppData\Local\Temp\F29.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\FD5.tmp"C:\Users\Admin\AppData\Local\Temp\FD5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\10CF.tmp"C:\Users\Admin\AppData\Local\Temp\10CF.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\117B.tmp"C:\Users\Admin\AppData\Local\Temp\117B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\1236.tmp"C:\Users\Admin\AppData\Local\Temp\1236.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\12C3.tmp"C:\Users\Admin\AppData\Local\Temp\12C3.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\134F.tmp"C:\Users\Admin\AppData\Local\Temp\134F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\143A.tmp"C:\Users\Admin\AppData\Local\Temp\143A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\1524.tmp"C:\Users\Admin\AppData\Local\Temp\1524.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\15B1.tmp"C:\Users\Admin\AppData\Local\Temp\15B1.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\164D.tmp"C:\Users\Admin\AppData\Local\Temp\164D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\16E9.tmp"C:\Users\Admin\AppData\Local\Temp\16E9.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\1766.tmp"C:\Users\Admin\AppData\Local\Temp\1766.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\17F3.tmp"C:\Users\Admin\AppData\Local\Temp\17F3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\188F.tmp"C:\Users\Admin\AppData\Local\Temp\188F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\1C77.tmp"C:\Users\Admin\AppData\Local\Temp\1C77.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\1D04.tmp"C:\Users\Admin\AppData\Local\Temp\1D04.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"65⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"66⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"67⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\2001.tmp"C:\Users\Admin\AppData\Local\Temp\2001.tmp"68⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\208E.tmp"C:\Users\Admin\AppData\Local\Temp\208E.tmp"69⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\211B.tmp"C:\Users\Admin\AppData\Local\Temp\211B.tmp"70⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\21B7.tmp"C:\Users\Admin\AppData\Local\Temp\21B7.tmp"71⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\2244.tmp"C:\Users\Admin\AppData\Local\Temp\2244.tmp"72⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\22EF.tmp"C:\Users\Admin\AppData\Local\Temp\22EF.tmp"73⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\236C.tmp"C:\Users\Admin\AppData\Local\Temp\236C.tmp"74⤵PID:96
-
C:\Users\Admin\AppData\Local\Temp\2409.tmp"C:\Users\Admin\AppData\Local\Temp\2409.tmp"75⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\2495.tmp"C:\Users\Admin\AppData\Local\Temp\2495.tmp"76⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\2522.tmp"C:\Users\Admin\AppData\Local\Temp\2522.tmp"77⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\25AF.tmp"C:\Users\Admin\AppData\Local\Temp\25AF.tmp"78⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\265A.tmp"C:\Users\Admin\AppData\Local\Temp\265A.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\2706.tmp"C:\Users\Admin\AppData\Local\Temp\2706.tmp"80⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\27A3.tmp"C:\Users\Admin\AppData\Local\Temp\27A3.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\283F.tmp"C:\Users\Admin\AppData\Local\Temp\283F.tmp"82⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\28EB.tmp"C:\Users\Admin\AppData\Local\Temp\28EB.tmp"83⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"84⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\2A04.tmp"C:\Users\Admin\AppData\Local\Temp\2A04.tmp"85⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\2A91.tmp"C:\Users\Admin\AppData\Local\Temp\2A91.tmp"86⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\2B0E.tmp"C:\Users\Admin\AppData\Local\Temp\2B0E.tmp"87⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"88⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"89⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\2C94.tmp"C:\Users\Admin\AppData\Local\Temp\2C94.tmp"90⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2D21.tmp"C:\Users\Admin\AppData\Local\Temp\2D21.tmp"91⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"92⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"93⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2EE6.tmp"C:\Users\Admin\AppData\Local\Temp\2EE6.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\2F53.tmp"C:\Users\Admin\AppData\Local\Temp\2F53.tmp"95⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\308C.tmp"C:\Users\Admin\AppData\Local\Temp\308C.tmp"97⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\3118.tmp"C:\Users\Admin\AppData\Local\Temp\3118.tmp"98⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\31A5.tmp"C:\Users\Admin\AppData\Local\Temp\31A5.tmp"99⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\3232.tmp"C:\Users\Admin\AppData\Local\Temp\3232.tmp"100⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\32AF.tmp"C:\Users\Admin\AppData\Local\Temp\32AF.tmp"101⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\333B.tmp"C:\Users\Admin\AppData\Local\Temp\333B.tmp"102⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\33B8.tmp"C:\Users\Admin\AppData\Local\Temp\33B8.tmp"103⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\3435.tmp"C:\Users\Admin\AppData\Local\Temp\3435.tmp"104⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\34B2.tmp"C:\Users\Admin\AppData\Local\Temp\34B2.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\353F.tmp"C:\Users\Admin\AppData\Local\Temp\353F.tmp"106⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\35CC.tmp"C:\Users\Admin\AppData\Local\Temp\35CC.tmp"107⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\3677.tmp"C:\Users\Admin\AppData\Local\Temp\3677.tmp"108⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\36E5.tmp"C:\Users\Admin\AppData\Local\Temp\36E5.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3762.tmp"C:\Users\Admin\AppData\Local\Temp\3762.tmp"110⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\37DF.tmp"C:\Users\Admin\AppData\Local\Temp\37DF.tmp"111⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\385C.tmp"C:\Users\Admin\AppData\Local\Temp\385C.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\38D9.tmp"C:\Users\Admin\AppData\Local\Temp\38D9.tmp"113⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\3956.tmp"C:\Users\Admin\AppData\Local\Temp\3956.tmp"114⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\39D3.tmp"C:\Users\Admin\AppData\Local\Temp\39D3.tmp"115⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\3A50.tmp"C:\Users\Admin\AppData\Local\Temp\3A50.tmp"116⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"117⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\3B98.tmp"C:\Users\Admin\AppData\Local\Temp\3B98.tmp"118⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\3C25.tmp"C:\Users\Admin\AppData\Local\Temp\3C25.tmp"119⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"120⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"121⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"122⤵PID:5736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-