Analysis
- max time kernel
92s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 04:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_aa70201c7a7aacc15575f9de4ce1804d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_aa70201c7a7aacc15575f9de4ce1804d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260618-en
3 signatures
150 seconds
General
- Target 2026-06-27_aa70201c7a7aacc15575f9de4ce1804d_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260629-epln3scx8w
- SHA256 d8c27646f96f63adcfed97dcda077a5b0438b0274ea85ac23a0568ca1b816734
- MD5 aa70201c7a7aacc15575f9de4ce1804d
- SHA1 7cc3875d735f87e5cf02d59770b4ca64b866ae33
- SHA512 8f085d91fd65965b0630b5cfce4683cfac8194c1bdd1192cc0e012b2c829ccbcd9093989628956d6aacaf928a836240a91d6442af5f070ef0b4f1d486d04fcee
- SSDEEP 12288:9U5rCOTei6WaAyrxzyogSL2UGabV3cKRqZoXWjdqpby1grA70G+o:9UQOJ6WaAyOS7hbOCqqGh4yATXo
- TLSH T114E402217986C032F9C612344FE6EFB1593A7C715B2264C77B80B76D2FB52E1927834A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6868 605B.tmp 3828 60D8.tmp 5684 6136.tmp 5972 61B3.tmp 4396 6220.tmp 5776 627E.tmp 4564 62EB.tmp 6008 6349.tmp 3172 63C6.tmp 4548 64A1.tmp 1468 652D.tmp 6672 658B.tmp 6808 65F8.tmp 5768 6666.tmp 6260 66C4.tmp 3916 6731.tmp 5764 679E.tmp 5080 680C.tmp 4652 6879.tmp 1888 68D7.tmp 2612 6935.tmp 7116 69B2.tmp 6064 6A1F.tmp 1940 6A8C.tmp 4188 6AEA.tmp 5820 6B48.tmp 6592 6BA6.tmp 5832 6C03.tmp 936 6C61.tmp 3088 6CBF.tmp 6516 6D1D.tmp 1368 6D7A.tmp 4932 6DD8.tmp 5464 6E36.tmp 3532 6E94.tmp 4788 6EF1.tmp 3324 6F4F.tmp 2816 6F9D.tmp 4956 6FFB.tmp 1096 7068.tmp 2888 70D6.tmp 6208 7133.tmp 5324 71A1.tmp 4152 71EF.tmp 2980 724D.tmp 6920 72AA.tmp 3360 7318.tmp 3136 7366.tmp 1660 73D3.tmp 1124 7431.tmp 3120 749E.tmp 2812 74FC.tmp 1820 755A.tmp 2356 75B8.tmp 6264 7615.tmp 4568 7673.tmp 4612 76D1.tmp 1628 772F.tmp 3876 779C.tmp 1312 7819.tmp 6820 7877.tmp 6288 78D5.tmp 2676 7932.tmp 6520 7990.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6400.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 972A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 168C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1841.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9611.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B91A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5990.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7759.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A776.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 850A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C01F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 7144 wrote to memory of 6868 7144 2026-06-27_aa70201c7a7aacc15575f9de4ce1804d_elex_mafia_stealc_tofsee.exe 90 PID 6868 wrote to memory of 3828 6868 605B.tmp 91 PID 3828 wrote to memory of 5684 3828 60D8.tmp 92 PID 5684 wrote to memory of 5972 5684 6136.tmp 93 PID 5972 wrote to memory of 4396 5972 61B3.tmp 94 PID 4396 wrote to memory of 5776 4396 6220.tmp 95 PID 5776 wrote to memory of 4564 5776 627E.tmp 96 PID 4564 wrote to memory of 6008 4564 62EB.tmp 97 PID 6008 wrote to memory of 3172 6008 6349.tmp 98 PID 3172 wrote to memory of 4548 3172 63C6.tmp 99 PID 4548 wrote to memory of 1468 4548 64A1.tmp 100 PID 1468 wrote to memory of 6672 1468 652D.tmp 101 PID 6672 wrote to memory of 6808 6672 658B.tmp 102 PID 6808 wrote to memory of 5768 6808 65F8.tmp 103 PID 5768 wrote to memory of 6260 5768 6666.tmp 104 PID 6260 wrote to memory of 3916 6260 66C4.tmp 105 PID 3916 wrote to memory of 5764 3916 6731.tmp 106 PID 5764 wrote to memory of 5080 5764 679E.tmp 107 PID 5080 wrote to memory of 4652 5080 680C.tmp 108 PID 4652 wrote to memory of 1888 4652 6879.tmp 109 PID 1888 wrote to memory of 2612 1888 68D7.tmp 110 PID 2612 wrote to memory of 7116 2612 6935.tmp 111 PID 7116 wrote to memory of 6064 7116 69B2.tmp 112 PID 6064 wrote to memory of 1940 6064 6A1F.tmp 113 PID 1940 wrote to memory of 4188 1940 6A8C.tmp 114 PID 4188 wrote to memory of 5820 4188 6AEA.tmp 115 PID 5820 wrote to memory of 6592 5820 6B48.tmp 116 PID 6592 wrote to memory of 5832 6592 6BA6.tmp 117 PID 5832 wrote to memory of 936 5832 6C03.tmp 118 PID 936 wrote to memory of 3088 936 6C61.tmp 119 PID 3088 wrote to memory of 6516 3088 6CBF.tmp 120 PID 6516 wrote to memory of 1368 6516 6D1D.tmp 121 PID 1368 wrote to memory of 4932 1368 6D7A.tmp 122 PID 4932 wrote to memory of 5464 4932 6DD8.tmp 123 PID 5464 wrote to memory of 3532 5464 6E36.tmp 124 PID 3532 wrote to memory of 4788 3532 6E94.tmp 125 PID 4788 wrote to memory of 3324 4788 6EF1.tmp 126 PID 3324 wrote to memory of 2816 3324 6F4F.tmp 127 PID 2816 wrote to memory of 4956 2816 6F9D.tmp 128 PID 4956 wrote to memory of 1096 4956 6FFB.tmp 129 PID 1096 wrote to memory of 2888 1096 7068.tmp 130 PID 2888 wrote to memory of 6208 2888 70D6.tmp 131 PID 6208 wrote to memory of 5324 6208 7133.tmp 132 PID 5324 wrote to memory of 4152 5324 71A1.tmp 133 PID 4152 wrote to memory of 2980 4152 71EF.tmp 134 PID 2980 wrote to memory of 6920 2980 724D.tmp 135 PID 6920 wrote to memory of 3360 6920 72AA.tmp 136 PID 3360 wrote to memory of 3136 3360 7318.tmp 137 PID 3136 wrote to memory of 1660 3136 7366.tmp 138 PID 1660 wrote to memory of 1124 1660 73D3.tmp 139 PID 1124 wrote to memory of 3120 1124 7431.tmp 140 PID 3120 wrote to memory of 2812 3120 749E.tmp 141 PID 2812 wrote to memory of 1820 2812 74FC.tmp 142 PID 1820 wrote to memory of 2356 1820 755A.tmp 143 PID 2356 wrote to memory of 6264 2356 75B8.tmp 144 PID 6264 wrote to memory of 4568 6264 7615.tmp 145 PID 4568 wrote to memory of 4612 4568 7673.tmp 146 PID 4612 wrote to memory of 1628 4612 76D1.tmp 147 PID 1628 wrote to memory of 3876 1628 772F.tmp 148 PID 3876 wrote to memory of 1312 3876 779C.tmp 149 PID 1312 wrote to memory of 6820 1312 7819.tmp 150 PID 6820 wrote to memory of 6288 6820 7877.tmp 151 PID 6288 wrote to memory of 2676 6288 78D5.tmp 152 PID 2676 wrote to memory of 6520 2676 7932.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_aa70201c7a7aacc15575f9de4ce1804d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_aa70201c7a7aacc15575f9de4ce1804d_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:7144 -
C:\Users\Admin\AppData\Local\Temp\605B.tmp"C:\Users\Admin\AppData\Local\Temp\605B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6868 -
C:\Users\Admin\AppData\Local\Temp\60D8.tmp"C:\Users\Admin\AppData\Local\Temp\60D8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\6220.tmp"C:\Users\Admin\AppData\Local\Temp\6220.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\627E.tmp"C:\Users\Admin\AppData\Local\Temp\627E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\63C6.tmp"C:\Users\Admin\AppData\Local\Temp\63C6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6672 -
C:\Users\Admin\AppData\Local\Temp\65F8.tmp"C:\Users\Admin\AppData\Local\Temp\65F8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6808 -
C:\Users\Admin\AppData\Local\Temp\6666.tmp"C:\Users\Admin\AppData\Local\Temp\6666.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\66C4.tmp"C:\Users\Admin\AppData\Local\Temp\66C4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6260 -
C:\Users\Admin\AppData\Local\Temp\6731.tmp"C:\Users\Admin\AppData\Local\Temp\6731.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\6879.tmp"C:\Users\Admin\AppData\Local\Temp\6879.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\68D7.tmp"C:\Users\Admin\AppData\Local\Temp\68D7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\6935.tmp"C:\Users\Admin\AppData\Local\Temp\6935.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\69B2.tmp"C:\Users\Admin\AppData\Local\Temp\69B2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7116 -
C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\6B48.tmp"C:\Users\Admin\AppData\Local\Temp\6B48.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6592 -
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\6C61.tmp"C:\Users\Admin\AppData\Local\Temp\6C61.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6516 -
C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\6E94.tmp"C:\Users\Admin\AppData\Local\Temp\6E94.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7068.tmp"C:\Users\Admin\AppData\Local\Temp\7068.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\70D6.tmp"C:\Users\Admin\AppData\Local\Temp\70D6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\7133.tmp"C:\Users\Admin\AppData\Local\Temp\7133.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6208 -
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\72AA.tmp"C:\Users\Admin\AppData\Local\Temp\72AA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6920 -
C:\Users\Admin\AppData\Local\Temp\7318.tmp"C:\Users\Admin\AppData\Local\Temp\7318.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\7366.tmp"C:\Users\Admin\AppData\Local\Temp\7366.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\749E.tmp"C:\Users\Admin\AppData\Local\Temp\749E.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\74FC.tmp"C:\Users\Admin\AppData\Local\Temp\74FC.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\755A.tmp"C:\Users\Admin\AppData\Local\Temp\755A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\75B8.tmp"C:\Users\Admin\AppData\Local\Temp\75B8.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\7615.tmp"C:\Users\Admin\AppData\Local\Temp\7615.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6264 -
C:\Users\Admin\AppData\Local\Temp\7673.tmp"C:\Users\Admin\AppData\Local\Temp\7673.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\76D1.tmp"C:\Users\Admin\AppData\Local\Temp\76D1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\772F.tmp"C:\Users\Admin\AppData\Local\Temp\772F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\779C.tmp"C:\Users\Admin\AppData\Local\Temp\779C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\7877.tmp"C:\Users\Admin\AppData\Local\Temp\7877.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6820 -
C:\Users\Admin\AppData\Local\Temp\78D5.tmp"C:\Users\Admin\AppData\Local\Temp\78D5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6288 -
C:\Users\Admin\AppData\Local\Temp\7932.tmp"C:\Users\Admin\AppData\Local\Temp\7932.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\7990.tmp"C:\Users\Admin\AppData\Local\Temp\7990.tmp"65⤵
- Executes dropped EXE
PID:6520 -
C:\Users\Admin\AppData\Local\Temp\79FD.tmp"C:\Users\Admin\AppData\Local\Temp\79FD.tmp"66⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"67⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"68⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\7B26.tmp"C:\Users\Admin\AppData\Local\Temp\7B26.tmp"69⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\7B74.tmp"C:\Users\Admin\AppData\Local\Temp\7B74.tmp"70⤵PID:6696
-
C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"71⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\7C30.tmp"C:\Users\Admin\AppData\Local\Temp\7C30.tmp"72⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"73⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"74⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\7D49.tmp"C:\Users\Admin\AppData\Local\Temp\7D49.tmp"75⤵PID:6784
-
C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\7E05.tmp"C:\Users\Admin\AppData\Local\Temp\7E05.tmp"77⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"78⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"79⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\7F1E.tmp"C:\Users\Admin\AppData\Local\Temp\7F1E.tmp"80⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"81⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"82⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"83⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"84⤵PID:6772
-
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"85⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"86⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"87⤵PID:6488
-
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"88⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\826A.tmp"C:\Users\Admin\AppData\Local\Temp\826A.tmp"89⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\82D7.tmp"C:\Users\Admin\AppData\Local\Temp\82D7.tmp"90⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\8335.tmp"C:\Users\Admin\AppData\Local\Temp\8335.tmp"91⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\8393.tmp"C:\Users\Admin\AppData\Local\Temp\8393.tmp"92⤵PID:6184
-
C:\Users\Admin\AppData\Local\Temp\83F0.tmp"C:\Users\Admin\AppData\Local\Temp\83F0.tmp"93⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\844E.tmp"C:\Users\Admin\AppData\Local\Temp\844E.tmp"94⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\84AC.tmp"C:\Users\Admin\AppData\Local\Temp\84AC.tmp"95⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\850A.tmp"C:\Users\Admin\AppData\Local\Temp\850A.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:6640 -
C:\Users\Admin\AppData\Local\Temp\8567.tmp"C:\Users\Admin\AppData\Local\Temp\8567.tmp"97⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\85C5.tmp"C:\Users\Admin\AppData\Local\Temp\85C5.tmp"98⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"99⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\8681.tmp"C:\Users\Admin\AppData\Local\Temp\8681.tmp"100⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\86DE.tmp"C:\Users\Admin\AppData\Local\Temp\86DE.tmp"101⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\873C.tmp"C:\Users\Admin\AppData\Local\Temp\873C.tmp"102⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\879A.tmp"C:\Users\Admin\AppData\Local\Temp\879A.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\87F8.tmp"C:\Users\Admin\AppData\Local\Temp\87F8.tmp"104⤵PID:6744
-
C:\Users\Admin\AppData\Local\Temp\8855.tmp"C:\Users\Admin\AppData\Local\Temp\8855.tmp"105⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\88B3.tmp"C:\Users\Admin\AppData\Local\Temp\88B3.tmp"106⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"107⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\896F.tmp"C:\Users\Admin\AppData\Local\Temp\896F.tmp"108⤵PID:6432
-
C:\Users\Admin\AppData\Local\Temp\89BD.tmp"C:\Users\Admin\AppData\Local\Temp\89BD.tmp"109⤵PID:6840
-
C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"110⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\8A78.tmp"C:\Users\Admin\AppData\Local\Temp\8A78.tmp"111⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"112⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\8B34.tmp"C:\Users\Admin\AppData\Local\Temp\8B34.tmp"113⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\8B91.tmp"C:\Users\Admin\AppData\Local\Temp\8B91.tmp"114⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"115⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"116⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"117⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"118⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\8D57.tmp"C:\Users\Admin\AppData\Local\Temp\8D57.tmp"119⤵PID:7112
-
C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"120⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\8E02.tmp"C:\Users\Admin\AppData\Local\Temp\8E02.tmp"121⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\8E60.tmp"C:\Users\Admin\AppData\Local\Temp\8E60.tmp"122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-